A candidate falls: what Claude found in HAWK

On 28 July, Anthropic published two cryptanalysis results produced with its Claude Mythos Preview model. One improved an attack on a reduced-round variant of AES — theoretically interesting, practically irrelevant, and not our subject here. The other is a genuine problem for HAWK, a post-quantum signature scheme that NIST advanced to a third round of evaluation just ten weeks earlier. To understand why that matters, it helps to know what the NIST process is and where HAWK sits in it.

Two processes, not one

NIST has been running a public competition to replace RSA and elliptic-curve cryptography since 2016. It has produced three finished standards. It is also running a second, separate competition — an “on-ramp” opened in 2022 — purely for digital signatures, and that is a source of endless confusion, because people read a headline about a round-three candidate and assume it concerns something they might be running. It does not.

The main process [1][6]:

Date	Milestone
Dec 2016	Call for proposals
Dec 2017	82 submissions received; 69 accepted into round one
Jan 2019	26 advance to round two
Jul 2020	7 finalists and 8 alternates advance to round three
Jul 2022	Kyber, Dilithium, FALCON and SPHINCS+ selected; a fourth round opened for key exchange only
Aug 2024	FIPS 203, 204 and 205 published
Mar 2025	HQC selected as a second, non-lattice key exchange algorithm

What that has actually produced:

Standard name	From	Job	Maths family	Status
ML-KEM	Kyber	Key exchange	Structured lattices	Final — FIPS 203
ML-DSA	Dilithium	Signatures	Structured lattices	Final — FIPS 204
SLH-DSA	SPHINCS+	Signatures	Hash functions	Final — FIPS 205
FN-DSA	FALCON	Signatures	NTRU lattices	Draft — FIPS 206, final expected 2026–27
HQC	HQC	Key exchange	Error-correcting codes	Selected only; final standard expected 2027
LMS / XMSS	—	Signatures (stateful)	Hash functions	Final — SP 800-208, specialist use

Two words worth separating there. A key exchange algorithm — formally a KEM, or key encapsulation mechanism — is how two parties agree on a shared secret over an open channel, which is the opening move of every TLS connection. This is the urgent half of the problem, because traffic captured today can be decrypted years later once the key exchange falls. A digital signature algorithm proves who wrote something and that it has not been altered: certificates, code signing, firmware. Forging a signature after the fact is usually worthless to an attacker, so signatures are the slower-burning half — with the exception of anything whose validity runs for decades, like a root certificate or a firmware trust anchor.

The on-ramp exists because ML-KEM and ML-DSA are both built on structured lattices. If lattice mathematics ever breaks, both fall together. NIST wanted signature schemes resting on different foundations [2][3]:

Date	Milestone
Sep 2022	Call for additional signature schemes
Jun 2023	40 accepted into round one
Oct 2024	14 advance to round two
14 May 2026	9 advance to round three; CROSS, LESS, Mirath, PERK and RYDE eliminated
14 Aug 2026	Deadline for round-three specification changes
~2028	Round three concludes

The nine survivors [4][5]:

Candidate	Family	Based on
HAWK	Lattice	The Lattice Isomorphism Problem, using integer-only arithmetic
SQIsign	Isogeny	Maps between supersingular elliptic curves; extremely small signatures
FAEST	MPC-in-the-Head	Proving statements about AES
MQOM	MPC-in-the-Head	The multivariate quadratic problem
SDitH	MPC-in-the-Head	Syndrome decoding of random linear codes
UOV	Multivariate	The classic Unbalanced Oil and Vinegar construction
MAYO	Multivariate	UOV, restructured for smaller public keys
QR-UOV	Multivariate	UOV over quotient rings, odd characteristic
SNOVA	Multivariate	UOV with aggressive key compression

One of those nine is lattice-based. It is HAWK.

What HAWK is, and what went wrong

HAWK’s pitch was elegance. FALCON, the scheme becoming FIPS 206, is notoriously awkward to implement safely because its signing step needs floating-point arithmetic that is very difficult to make constant-time. HAWK does the same job using nothing but integers, signs several times faster, and produces signatures around 15% smaller than FALCON’s [7]. For constrained hardware — smartcards, IoT, secure elements — that combination is genuinely attractive.

Its security rests on the Lattice Isomorphism Problem. A HAWK private key is a “nice” basis for a lattice of dimension 2n, where n is the scheme’s degree parameter: 512 or 1024 in the real parameter sets. The public key is an ugly, scrambled description of the same lattice. Recovering the private key means finding your way back from the ugly description to the nice one, and the cost of doing that grows exponentially with n.

Working with Mythos Preview over about 60 hours, an Anthropic researcher found that HAWK’s lattice contains a symmetry — a nontrivial automorphism — that nobody had exploited. Earlier work had shown that such a symmetry would enable a faster attack, but left open whether one existed in HAWK’s particular lattice. It does. The symmetry lets an attacker fold the search space in on itself and skip roughly half the work, in the specific sense that attacking a degree-n HAWK lattice now costs about what attacking a degree-n/2 lattice cost before.

Reading the numbers honestly

Anthropic’s summary says the attack “halves the effective key size”, and the coverage has repeated it. That phrasing has caused confusion, so it is worth unpacking.

Nothing halves the length of anything. Cryptographers describe strength in bits of security, which is not a measurement of size. Saying a scheme offers 150 bits of security means the best known attack against it needs roughly 2^150 elementary operations. It says nothing about how many bytes the key occupies — HAWK’s public keys are around a kilobyte either way.

So the figures are operation counts. Anthropic demonstrated the attack end-to-end against HAWK-256, where the expected cost of full key recovery drops from about 2^64 operations to about 2^38 [8]. That is roughly 18 quintillion down to roughly 275 billion — from “no one is doing that” to a few hours on a decent desktop. HAWK-256, though, is a deliberate practice target published by the HAWK team for exactly this purpose; it was never a deployment option. The real parameter sets fare far better. Technical coverage of the papers puts HAWK-512 at 2^150 down to 2^108, and HAWK-1024 at 2^288 down to 2^182 [9]. Both remain comprehensively out of reach of anything that exists or is likely to exist. The attack is faster, but it is still exponential — it is not a break.

The damage is commercial, not catastrophic. To restore the security margin its designers intended, HAWK has to double n. Key and signature sizes scale linearly with n, so keys and signatures double too — and compactness was the entire argument for choosing HAWK over FALCON. A doubled HAWK is slower to transmit, larger in certificate chains, and loses to the scheme it was competing against. It keeps its implementation simplicity, which is a real virtue, but that is a much thinner case to make to NIST. The deadline for round-three specification changes is 14 August 2026.

What to take from it

Nothing here touches a system you operate. HAWK is not deployed anywhere; there is no patch and no vendor conversation to have. ML-KEM, ML-DSA and SLH-DSA are unaffected, and Anthropic is explicit that the technique is specific to HAWK rather than to lattice cryptography generally.

This is also, straightforwardly, the process working as designed. NIST publishes candidate specifications precisely so that people will attack them before anyone deploys them; SIKE was broken on a laptop in an hour during the previous competition, and the system absorbed it. HAWK had survived two rounds and two years of expert scrutiny, which says less about the quality of that scrutiny than about the value of adding a reviewer that does not get bored.

The part worth sitting with is the economics. The discovery took 60 hours and about US$100,000 of compute, directed by a researcher who was not a lattice specialist. Verification took considerably longer than discovery. If that ratio holds as models improve, the constraint on cryptanalysis stops being the supply of expert attackers and becomes the supply of expert reviewers — and every scheme that has survived on the strength of “nobody has found anything yet” gets a second look it was not expecting.

There is no prize for going last.

---

Kaysec is the post-quantum security practice of Spinsphere, a New Zealand-based quantum technology company. We help organisations with cryptographic inventory, HNDL risk assessment, TLS configuration auditing, and PQC migration planning. Get in touch.

References

1. NIST CSRC, Post-Quantum Cryptography Standardization Process, updated 16 June 2026. https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization
2. Alagic, G. et al., Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8528, October 2024. https://csrc.nist.gov/pubs/ir/8528/final
3. NIST CSRC, Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process, 14 May 2026. https://csrc.nist.gov/News/2026/nist-advances-9-candidates-to-the-3rd-round-of-pqc
4. Moody, D. et al., Status Report on the Second Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8610, 14 May 2026. https://doi.org/10.6028/NIST.IR.8610
5. Abdel-Kareem, M., “NIST Advances Nine Post-Quantum Digital Signature Candidates to Third Evaluation Round”, Quantum Computing Report, 18 May 2026. https://quantumcomputingreport.com/nist-advances-nine-post-quantum-digital-signature-candidates-to-third-evaluation-round/
6. NIST, “NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption”, 11 March 2025. https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption
7. Ducas, L. et al., “Hawk: Module LIP Makes Lattice Signatures Fast, Compact and Simple”, ASIACRYPT 2022.
8. Anthropic Frontier Red Team, “Discovering cryptographic weaknesses with Claude”, 28 July 2026. https://www.anthropic.com/research/discovering-cryptographic-weaknesses
9. The Hacker News, “Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack”, 29 July 2026. https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html