AI Cracks a NIST Post-Quantum Signature Candidate

An Anthropic research team gave an AI model a lattice-based signature scheme that had already survived two rounds of expert review inside NIST’s post-quantum standardization process. Sixty hours later, the model had cut the scheme’s effective key strength in half. Within a day of getting the result, the algorithm’s own designers pulled it from consideration. If you track PQC standards for a living, that’s the story from the last few weeks that should actually change how you think about your migration timeline, not the vendor press releases about new hardware security modules.

What happened to HAWK

HAWK is a lattice-based digital signature scheme that made it to the third round of NIST’s Additional Digital Signatures process, the parallel track NIST runs to find more post-quantum signature options beyond ML-DSA and SLH-DSA (the ones already finalized as FIPS 204 and FIPS 205). HAWK had gone through two years and two rounds of public scrutiny by cryptographers before Anthropic pointed Claude Mythos Preview at it in June.

Working semi-autonomously in a sandboxed research harness, with access to Python, Sage, and published cryptography papers, Mythos found something the human reviewers had missed: a nontrivial automorphism in the lattice structure HAWK’s security depends on. Exploiting it produced a faster key-recovery attack, one that dropped the cost of breaking HAWK-256 from roughly 2^64 operations to about 2^38. That’s still an exponential-time attack, not a total break, but it means HAWK’s keys would need to double in size to hit their original security target. Doubling the keys erases most of what made HAWK attractive in the first place: it was pitched as a compact, fast alternative to bulkier lattice schemes.

Anthropic disclosed the finding to HAWK’s designers privately, then coordinated public disclosure through NIST’s mailing list. The HAWK team confirmed the attack and withdrew the scheme from the standardization process within 24 hours.

Why this isn’t a fire drill

If you’re running a PQC migration right now, none of this touches your actual deployment. HAWK was never standardized and never shipped anywhere. The finding doesn’t affect ML-KEM (FIPS 203), ML-DSA (FIPS 204), or SLH-DSA (FIPS 205), the three algorithms you should already be piloting or deploying. It also doesn’t say anything bad about the other eight candidates still in round three: FAEST, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV. Anthropic was explicit that the attack is specific to HAWK’s particular lattice structure and doesn’t generalize.

This is also, honestly, the standardization process doing exactly what it’s supposed to do. NIST publishes candidates precisely so the cryptography community can try to break them before anyone builds a product on top of one. It happened during the original ML-KEM/ML-DSA rounds too: SIKE, a once-promising isogeny-based scheme, got fully broken on a single laptop in about an hour back in 2022. A late-stage failure is a sign the review process is working, not a sign the whole PQC effort is shaky.

The part worth paying attention to

What’s actually new here isn’t that a PQC candidate failed. It’s what found the flaw. Two years of expert human review missed this. An AI model working mostly on its own found it in 60 hours, at a cost Anthropic put at around $100,000 in compute. In a related result from the same research push, the same model also improved the fastest known attack on a reduced, 7-round version of AES-128 by 200 to 800 times (still nowhere close to threatening the full 10-round cipher your TLS stack actually uses, but a real research result against one of the most heavily studied ciphers in existence).

Here’s the detail that stuck with me, reading Anthropic’s writeup: the bottleneck used to be finding weaknesses. Now it’s verifying them. The HAWK attack was easy enough to check because it runs end to end, you plug in a key and watch it get recovered. The AES result was messier. Anthropic’s own researchers, who aren’t lattice or block-cipher specialists by training, spent nearly a month confirming a result the model produced in about a week. That gap between “the AI found something” and “we’re sure the AI is right” is going to define how this plays out over the next few years, and it’s not obviously in the humans’ favor.

What to actually do with this

Don’t touch your migration plan because of HAWK. If you’re already building around ML-KEM and ML-DSA, none of this changes anything for you. What it should do is put two older warnings back on your radar. A candidate that looks settled in round three of a standardization process can still get pulled with 24 hours’ notice, so don’t wire yourself to a specific algorithm any harder than you have to. Build in the ability to swap it out. And it’s worth actually watching the remaining round-three signature candidates (FAEST, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV) over the next year, because AI-assisted cryptanalysis is now part of how they get stress-tested, and that’s moving faster than the two-year clock NIST built the process around.