AI broke a post-quantum signature in 60 hours. The signature is not the problem

Cryptography has always run on one rule: propose an algorithm, let the world attack it, trust whatever survives. It is a good rule, and it is the only one we have. But it hides a parameter — time. "Survived" means "survived this many expert-years."

On July 28, Anthropic published work in which that parameter stopped being a constant.

What happened

HAWK is a digital signature scheme, one of the remaining third-round candidates in NIST's call for additional post-quantum signatures. Two years of expert review behind it. Its security rests on the Lattice Isomorphism Problem.

Claude Mythos Preview found a nontrivial automorphism in HAWK's lattice structure — a symmetry nobody had thought to exploit. It speeds up enumeration attacks enough that for the HAWK-256 parameter set, the expected cost of recovering a key drops from 2⁶⁴ to 2³⁸ operations. Roughly 67 million times less work.

That took 60 hours and about $100,000 in API costs. One human was involved, a theoretical computer scientist rather than a lattice cryptographer, and Anthropic describes his contribution as limited to "project management."

The second result targets AES cut down to 7 rounds out of 10. The model worked almost entirely autonomously for three days, produced roughly a billion output tokens, and invented a new technique it named the Möbius Bridge, improving on the known attack by a factor of 200–800. Researchers then spent several hundred hours learning enough cryptography to confirm the result was real.

Why it is still news

The temptation to read this as "nothing broke, carry on" is strong. Something did break — just not an algorithm. An assumption.

Every plan to migrate to post-quantum cryptography — in blockchains, in banks, in your product — implicitly rests on an estimate: classical cryptanalysis improves at a predictable, slow pace. That is why migration windows get measured in years and why the task comfortably slides to next quarter. The estimate was reasonable, because the speed of cryptanalysis was set by how many people were willing to spend years of their lives on one specific scheme.

That speed now has a second multiplier, and it costs a hundred thousand dollars per attempt.

Note the asymmetry. Finding the attack took a person with no expertise in the field and one weekend's budget. Verifying it took hundreds of hours from people picking up that expertise as they went. Search is getting cheaper faster than verification is. For an industry whose safety rests on defenders checking more than attackers can find, that is an awkward direction of travel.

What to do in the two weeks before a smart-contract audit

What it means for blockchains

Precision matters here, because there is a lot of empty noise around this topic.

Neither Bitcoin nor Ethereum is affected. Both sign transactions with elliptic curves, and neither attack aimed there. HAWK is not among the schemes Bitcoin would migrate to.

The interesting part is how the migration plan itself is built. BIP-360, the proposal for quantum-resistant addresses, specifies three already-standardized NIST algorithms, and does so deliberately — so users keep a fallback if one of them is later broken, by a quantum computer or by classical progress. A year ago that redundancy looked like sensible caution. After Anthropic's work it looks like the minimum.

Then there is the price of "fixing" HAWK. Formally it is repairable: double the key sizes and the security level comes back. But Anthropic writes plainly that doubling "eliminates many of the reasons making the scheme an attractive PQC signature candidate." For a blockchain this is not abstract: signature size is block space, and block space is fees. Compact keys and fast signing were HAWK's entire pitch. The attack did not kill the scheme mathematically. It killed it economically.

What to do in your architecture

The practical takeaway is not "change your cryptography now." It is duller and more useful: check whether you could change it at all.

• The algorithm should be a parameter, not a constant. If the signature scheme is baked into your data formats, your addresses, your deployed smart contracts, you do not have a migration plan — you have an intention. Swapping algorithms should be a release, not a rewrite.
• Ship more than one scheme, the way BIP-360 does. A single scheme is a bet that this particular one survives the next decade of review. That bet just got more expensive.
• Version everything you sign. Data that outlives an algorithm change has to carry a marker of what signed it. Retrofitting that is painful.
• Separate "broken" from "became expensive." HAWK is the second case. Your threat model needs an answer for that outcome too: the scheme is formally alive, but its parameters grew until the product economics stopped working.
• Re-examine your planning horizon. If your migration plan rested on "we have a few years," it is worth remembering where that number came from.

What this does not prove

The other side deserves stating, because a story like this makes panic easy to build.

This is not "AI broke cryptography." Both attacks remain exponential in time. The HAWK result, as Anthropic notes, does not carry over to other NIST post-quantum candidates or to lattice-based cryptography in general. The AES result does not carry over to other ciphers in the same family.

Nor is it a story about a fully autonomous model. In both cases a human framed the problem, built the scaffold, and then spent hundreds of hours checking the answer. Anthropic specifically mentions three interventions in which the researcher nudged the model toward a novel approach rather than an obvious one.

And it is not a one-off stunt for a headline. Alongside the results, Anthropic released CryptanalysisBench — a benchmark over a set of ciphers, built with academic groups from ETH Zurich, Tel Aviv University and TU Berlin, so that models' cryptanalytic ability can be measured externally and over time. That is the mark of authors who consider the effect a trend rather than an incident.

Anthropic disclosed the finding to HAWK's authors in June and coordinated publication with the NIST mailing list — responsible disclosure worked as it should. That is the most reassuring detail in the whole story: a tool that accelerates the search for weaknesses landed in hands that warn first and publish second. Which is exactly what to plan around — that next time it may not.