AI Model Claude Mythos Discovers New Flaws in HAWK Post‑Quantum Signature Scheme and Accelerates Reduced‑Round AES Attacks
What Happened — Anthropic’s Claude Mythos Preview autonomously identified a mathematical symmetry in the HAWK post‑quantum signature algorithm that cuts its effective security margin in half, and it generated a 200‑ to 800‑fold faster attack against a reduced‑round version of AES. Neither finding compromises any production system today, but both demonstrate that frontier AI can conduct original cryptographic research faster than human experts.
Why It Matters for Compliance & Audit Readiness
- SOC 2’s Encryption (CC6.1) and System Operations (CC3.1) controls require documented justification for algorithm selection and continuous monitoring of cryptographic strength.
- An AI‑driven discovery of algorithmic weaknesses creates a new risk vector that must be tracked as part of a continuous‑compliance evidence pipeline.
- Verisq’s Control‑Mapping capability can automatically map emerging cryptographic findings to the relevant SOC 2 controls and generate audit‑ready evidence of remediation.
Who Is Affected — Organizations that have adopted or are evaluating post‑quantum signatures (e.g., HAWK) or rely on AES‑based encryption, spanning fintech, cloud SaaS, government, and telecom sectors.
Recommended Actions
- Inventory all systems that use HAWK or reduced‑round AES and map them to SOC 2 CC6.1 encryption controls.
- Incorporate threat‑intel feeds on AI‑generated cryptographic research into your continuous‑control monitoring process.
- Document any algorithm upgrades or mitigations as audit evidence; consider temporary key‑size adjustments for HAWK until NIST finalizes its guidance.
Source: Security Affairs
Technical Notes
- HAWK: Symmetry in the underlying lattice reduces attack cost from 2⁶⁴ to 2³⁸ operations (HAWK‑256). Doubling key size restores original security but erodes performance benefits.
- Reduced‑Round AES: Attack on a truncated AES variant runs 200‑800× faster than prior academic results, though full‑strength AES remains unbroken.
- Research was performed over ~60 hours with minimal human guidance; the AI generated a full verification pipeline.
Source: same as above