60 hours of AI cryptanalysis. HAWK's authors pulled it from NIST's post-quantum race.

HAWK is out of NIST’s post-quantum signature competition, and an AI model is why. Anthropic’s Claude Mythos Preview found a symmetry in HAWK’s lattice that slashes the cost of stealing a secret key, and the scheme’s own authors withdrew it days later.

That sequence is the story, and it isn’t the one most headlines imply. No deployed system got weaker this week. HAWK was a candidate, never a standard, and NIST’s finished picks are untouched. What changed is the arithmetic of standards review: HAWK had cleared two rounds of public scrutiny since 2023, and roughly 60 hours of model work found what that scrutiny missed.

What the attack actually did

HAWK sold itself on speed. Small keys, integer-only signing, no floating-point math, all of which made it the quickest option left in NIST’s additional-signatures on-ramp. Anthropic’s research post describes what Claude Mythos Preview found instead: a nontrivial automorphism in the key lattice, a hidden symmetry that earlier papers had flagged as dangerous without ever locating it inside HAWK. The rest is bookkeeping. Feed that symmetry into a known block-reduction algorithm and the dimension an attacker has to search roughly halves.

Four numbers carry the result:

• Key recovery against HAWK-256 dropped from about 2^64 operations to 2^38, per Anthropic, and the accompanying paper by Zygimantas Straznickas and Stephen Weis reports recovering a real HAWK-256 secret key end to end in a few hours on a single server.
• Gate-count estimates for the sizes people would actually deploy also fell, HAWK-512 from 2^150 to 2^108 and HAWK-1024 from 2^288 to 2^182, which still leaves both comfortably out of reach.
• The work ran about 60 hours in a multi-agent setup and cost roughly $100,000 in API usage, The Hacker News reported.
• HAWK was the only lattice-based cryptography entry among the nine candidates NIST advanced in May 2026. Its round-3 listing now reads: “The submission team has withdrawn HAWK from the additional digital signatures standardization process.”

Why the authors folded

Halving a security level doesn’t normally kill a scheme. Doubling the parameters restores the margin. HAWK’s problem is that efficiency was its whole case, so bigger keys erase the reason to pick it over the alternatives. The submission team said straightforward mitigations, including doubling parameters or moving to higher-rank modules, would leave the scheme uncompetitive, a conclusion ExeQuantum’s Samuel Tseitkin also records in his July 30 breakdown.

Johns Hopkins cryptographer Matthew Green, who has reviewed this class of scheme for years, was blunt about the method in his own write-up: “The TL;DR is that someone just did a much more thorough job applying all of our known tools.” No new mathematics. Just a more complete sweep of the existing toolbox than any human team had run.

What is still unclear

Three things stay open. Anthropic hasn’t published a full split of how much of those 60 hours was model time versus researcher steering, and CSO Online notes that validating Anthropic’s separate 7-round AES-128 result took two researchers nearly a month. That AES work doesn’t touch the full 10-round cipher, so production AES is fine. Whether the method reaches other schemes is unsettled too: the paper says the construction does not transfer to Falcon and that some ring conductors evade it, but “does not transfer” describes one attack, not the next one. And NIST hasn’t said whether the remaining eight candidates get a different kind of review.

What this means for you

Nothing on your servers changes today. HAWK never shipped, and the algorithms in the federal migration plan, ML-KEM for key establishment and ML-DSA for signatures, are untouched by this work. If you’re already on the clock from the White House’s 2030 post-quantum cryptography deadline, keep going exactly as planned.

Review capacity is the part worth watching. Mythos already produced 271 Firefox bug fixes in a single Mozilla run and now runs on the defensive side of security work, and the same imbalance has arrived in cryptography: models generate candidate attacks faster than experts can check them. Anthropic’s own framing is that standard human processes “struggle to keep up.” My read: treat “survived N rounds of expert review” as a weaker safety signal than it was in June, and expect the next standards cohort to be machine-reviewed before it lands, not after.