QWE AI Academy Here’s the detail that got buried in the headlines: when Anthropic pointed Claude at a 7-round version of AES, the model initially refused, claiming no improvement was possible. A researcher sent three encouraging prompts over three days. Only then did Claude engage – and eventually invent a technique it named the Möbius Bridge that made the attack 200-800× faster.
That’s not a heroic AI story. That’s a prompting story. And it’s exactly what makes the July 28, 2026 Anthropic paper on discovering cryptographic weaknesses with Claude useful for the rest of us – even those of us who’ll never touch the Mythos model that did the work.
What actually happened (the short version)
Anthropic’s research post describes two findings from Claude Mythos Preview, its restricted frontier model. Claude significantly weakened HAWK, a post-quantum digital signature scheme being evaluated by NIST, and improved an attack on a reduced version of AES by between 200 and 800 times.
HAWK has not been deployed, and the AES attack applies only to a seven-round research version rather than the complete ten-round AES-128 cipher used in production. Nothing you’re running right now is broken. The interesting part is the process.
HAWK had survived two years of expert review. In 60 hours, Mythos Preview found a previously unknown attack that reduced the scheme’s key strength by half – for the smallest HAWK-256 configuration, the estimated cost of recovering a key fell from 2^64 operations to 2^38.
Why the scaffolding matters more than the model
Most coverage focuses on Mythos itself. But Mythos is gated – Anthropic released it to a limited group of tech companies through what it calls Project Glasswing, not to the general public. What is reproducible is the setup around it.
Anthropic calls this the “scaffold” – a set of prompts and code that helps the model achieve its goal, built on top of Claude Code, with an environment where it can safely run experiments and log results. The interesting empirical result buried in the paper: after confirming the HAWK break, Anthropic tested whether the same scaffold that had attacked AES could also re-discover the HAWK break. It could.
Translation: the use Anthropic wrapped around the model was more portable than any single finding. That’s the part a beginner can imitate today with Claude Opus or Sonnet on a much smaller problem.
How to actually try this with the Claude you have access to
You will not reproduce a HAWK break. What you can do is use Claude to audit cryptographic code you own – the same category of work Filippo Valsorda documented when he used Claude Code with Opus 4.1 (as of mid-2026) to debug his ML-DSA implementation in the Go standard library, kicking off a session with a plain prompt describing the failing test, telling Claude where the code lived, and letting it iterate.
The pattern that mirrors what Anthropic did, scaled down:
- Give Claude a runnable environment. Not a chat window with pasted snippets – an actual repo it can execute against. Claude Code, or the API with tool use, both work.
- State the invariant, not the answer. “Tests are failing against this known-good vector” beats “find the bug.” The invariant is what the scaffold checks after every model iteration.
- Log everything and let it iterate. Anthropic’s own scaffold logged experiment results so the model could reason over prior attempts. Without that memory, long runs collapse.
- Push back when it gives up. This is the part almost no tutorial mentions. Claude will conclude “no improvement is possible” and stop. The AES result required three encouragement prompts across three days before Claude engaged productively.
A minimal starter prompt for auditing your own crypto code:
<context>
I'm reviewing [file/module] for cryptographic weaknesses.
Run tests with: [exact command]
Known-good test vectors are in: [path]
</context>
<task>
1. Read the implementation.
2. Check for: timing-dependent branches on secret data,
weak primitives (MD5/SHA-1/DES/ECB), algorithm confusion
(e.g. JWT alg=none), and constant-time violations.
3. For each finding, produce a failing test vector.
4. Do not stop until either all checks pass or you have
a concrete reproducer.
</task>The categories in that prompt are not made up. Per Anthropic’s Claude Security documentation, the product explicitly flags secret-dependent branches, JWT alg=none, and weak primitives like MD5/SHA-1/DES/ECB in security paths. So this is the model checking against its own documented taxonomy.
Common pitfalls (the ones the news articles skipped)
The refusal problem. The CryptanalysisBench paper notes something worth reading twice: researchers were unable to evaluate GPT-5.6 and Claude Fable-5, whose safeguards blocked their cryptanalysis evaluations – only Mythos-5 was accessible through the Anthropic collaboration. If you ask consumer Claude to “break AES,” expect a refusal. Frame the work as auditing your own code and it usually cooperates. Frame it as academic cryptanalysis of a research primitive and it sometimes cooperates. Frame it as “help me attack this system” and you’re done.
Pro tip: When Claude refuses or claims a task is impossible, treat that as a prompting problem, not a truth claim. Anthropic’s own researcher had to prod the model across three separate days before it produced the Möbius Bridge idea. Persistence with new framing is part of the technique.
The false-positive silence. Anthropic did not report a false-positive rate for any of the cyber benchmarks it published for Mythos. For you, this means: assume some fraction of Claude’s “findings” in a cryptography audit are noise. Every alleged bug needs a reproducer before you touch the code.
The cost trap. Each Anthropic discovery cost roughly $100,000 in API compute – that’s for a frontier model plus a scaffold running for days, and Claude generated around one billion output tokens for the AES work alone. A serious audit of a nontrivial cryptography module with Opus 4 will still burn real money – budget for tens or hundreds of dollars per session, not cents.
How this compares to just using a static analyzer
Cryptography auditing has existed for a long time. The honest comparison:
| Approach | Finds implementation bugs | Finds algorithmic flaws | Explains why | Cost profile |
|---|---|---|---|---|
| Traditional static analyzer | Yes (pattern-based) | No | Rarely | Fixed license |
| Claude (Opus/Sonnet) with a scaffold | Yes, and reasons about context | Sometimes, if guided | Yes, in prose | Per-token, unpredictable |
| Claude Mythos Preview | Yes, at scale | Demonstrated (HAWK, AES-7) | Yes | Not available to you |
The practical difference: Claude Security, per Anthropic’s documentation, flags the same categories as a static analyzer – MD5, ECB mode, JWT alg=none – but can also reason about how those primitives interact with surrounding logic. A grep for MD5 finds MD5. It doesn’t find “this function is constant-time except when the input length is exactly 16, which happens on the wire boundary.”
The catch: pattern matchers don’t hallucinate. Claude does.
What to do this week
Pick one small piece of cryptographic code you own – a JWT handler, a password hasher, a token comparator. Open Claude Code or a Claude API session with tool use. Give it the audit prompt above. Run it. Then verify every finding by hand before believing any of them.
That’s the exercise. Not because you’ll break AES, but because you’ll build the intuition for when Claude is doing real analysis versus when it’s confidently wrong. Which turns out to be the same skill Anthropic’s researchers needed to make the news.
FAQ
Can I access Claude Mythos Preview?
No. It’s limited to Project Glasswing partners – a closed group of large tech and financial companies, as of July 2026.
Will Claude Sonnet or Opus refuse to help me audit crypto code?
It depends heavily on framing. If you say “here is a JWT library I maintain, check for algorithm confusion and weak primitives,” it will almost always cooperate – that matches the exact categories in Anthropic’s own Claude Security taxonomy. If you paste an unknown binary and ask “break this,” expect a refusal. The safeguards react to intent signals as much as to content, which is why the CryptanalysisBench team couldn’t even evaluate some consumer models on academic cryptanalysis.
Is this actually useful for a small team, or is it a frontier-lab-only trick?
Useful – but not in the way the headlines suggest. You’re not going to discover novel attacks on standards. You are going to catch real bugs in your own cryptographic code faster than a code review would, and you’ll get plain-language explanations that help junior engineers understand why something is wrong. The Filippo Valsorda write-up on debugging ML-DSA in the Go standard library is the realistic ceiling for what a skilled individual can do with today’s public Claude. That’s still a meaningful ceiling.