Notes on the Anthropic cryptographic blogpost

Notes on the Anthropic cryptographic blogpost 图片 1
Notes on the Anthropic cryptographic blogpost 图片 2
Notes on the Anthropic cryptographic blogpost 图片 3
Notes on the Anthropic cryptographic blogpost 图片 4

Status: Mostly a summary with some of my notes at the end.

Anthropic released a blogpost yesterday (07/28/26) describing how Claude Mythos Preview found improved ways to attack some cryptographic algorithms. While neither of the attacks they describe are a current threat to any production systems, I do expect models to continue getting substantially better at this. I’m not any sort of cryptography expert though, and am not sure how much of a threat model this is. Two different attacks were covered in the blogpost, one against HAWK, and one against a weakened version of AES, with full research papers available (see prior links).

HAWK is the result that’s more actively helpful/valuable. HAWK is one of nine remaining candidates as part of the NIST call for Additional Digital Signatures, an effort to standardize new Post-Quantum Cryptographic (PQC) schemes, something that’s important as building a cryptographically-relevant quantum computer becomes closer to possible, threatening classical cryptography. The attack Mythos discovered means that one would need to double the size of HAWK keys to achieve the same level of security, which eliminates many of the reasons making HAWK a good PQC signature candidate. It was the only lattice-based candidate remaining, although three of the five main PQC standardizations are lattice-based.

To find it, Anthropic used a Claude Code-like harness that supports multiple agents in a sandboxed environment. A human operator ran the experiment, but did not have particularly relevant cryptographic expertise, input was limited to project management. They mention the multi-agent workflow was valuable and the key idea in producing this attack was discovered by a pair of agents working together. Finding, developing and verifying the attack took about 60 hours and $100k in API cost.

The second result was on a weaker version of AES, a commonly used/scrutinized encryption algorithm that was adopted in 2001. AES-128 encrypts an input by repeatedly…

添加评论
点赞收藏
点踩分享查看原文
评论
?
参与讨论