A breakthrough in cryptographic research has emerged with Anthropic’s Frontier Red Team unveiling new vulnerabilities in two security algorithms: HAWK and a simplified version of AES. While the findings are significant, they don’t spell the digital apocalypse some headlines suggest. Here’s what you need to know.
HAWK’s post-quantum flight ends abruptly
HAWK was a promising candidate for post-quantum cryptographic standards, proposed in response to a NIST call to complement the four algorithms selected in 2022. After successfully passing two rounds of expert evaluation over two years, it faced an unexpected setback.
The vulnerability was uncovered using Mythos, a pre-release version of Anthropic’s AI model. By exploiting a geometric symmetry in HAWK’s reliance on the module Lattice Isomorphism Problem, researchers reduced the key search complexity from 2⁶⁴ to 2³⁸ operations. In practical terms, this meant extracting a secret key in just 3 hours and 42 minutes on a standard 96-core server.
The impact? The HAWK team withdrew the algorithm from the NIST selection process immediately upon learning of this vulnerability. Doubling key sizes to restore security would have compromised HAWK’s primary advantage—its computational efficiency.
What about AES? A theoretical, not practical, concern
The other focus of the research was the Advanced Encryption Standard (AES), one of the most widely used symmetric encryption algorithms globally. However, the vulnerability identified applies only to a deliberately weakened version of AES-128, reduced to seven rounds instead of the standard ten.
Anthropic’s team developed a novel Möbius Bridge technique, integrating invariant fingerprinting into a meet-in-the-middle attack. This innovation eliminated an exhaustive search step requiring 256 iterations, accelerating the attack by a factor of 200 to 800 compared to prior work from 2013.
Crucially, the ANSSI notes that this vulnerability remains confined to academic research. The additional three rounds in the standard AES implementation render such attacks impractical. For those seeking post-quantum security, the agency recommends using keys of at least 192 bits, with minimal performance impact.
Reflections on AI-driven cryptanalysis
Beyond the technical findings, this research highlights the evolving role of AI in cryptanalysis. The HAWK vulnerability required about 60 hours of autonomous computation, costing $100,000 in API usage. Interestingly, the pre-release version of Mythos initially refused to address the reduced AES task, deeming it too robust. After adjustments to the research scaffolding, the model generated roughly a billion tokens over several days to devise the attack.
The findings were rigorously validated by two researchers over a month, ensuring mathematical rigor and eliminating potential hallucinations. This underscores a growing challenge in cybersecurity: the human bottleneck in validating AI-generated discoveries. While AI accelerates vulnerability discovery, the validation process remains time-consuming and resource-intensive.
The shifting bottleneck in cybersecurity
This episode reflects a broader trend: the real challenge in cybersecurity is no longer finding vulnerabilities but validating the sheer volume of discoveries. With AI uncovering flaws at an unprecedented pace, human experts struggle to keep up. The situation is evident in the surge of patches across major platforms like Firefox, Windows, and Apple systems.
The Anthropic team’s work is part of a series of experiments, hinting at more publications to come. While the immediate impact on current systems is minimal, these findings serve as a reminder of the need for continuous vigilance and adaptation in the face of advancing AI capabilities.
