An AI found math flaws in two encryption systems, but neither affects production traffic

Anthropic used Claude to find mathematical weaknesses in two encryption systems: HAWK, a post-quantum digital-signature candidate under NIST review, and a reduced-round version of AES, the symmetric cipher behind most web traffic. Neither result affects any software that protects real traffic today.

Earlier Claude security work surfaced implementation bugs, where callers of a cryptographic library misused the code. The new findings target the algorithms themselves. Anthropic's researchers steered the model away from "low-hanging fruit" toward publishable mathematical flaws, then released three companion artifacts: the HAWK key-recovery paper, the AES Möbius Bridge paper, and a chain-of-thought document on methodology.

HAWK is a Round 1 candidate in NIST's post-quantum digital-signature review, not a deployed standard. Production AES uses the full round count; the attack targets an academic, round-reduced variant. Anthropic's research blog is the only analyst on record so far. A separate arXiv preprint, CryptanalysisBench, sketches an evaluation framework for LLM-driven cryptanalysis. It is useful as a second-look reference but not an independent verification.

Independent cryptanalysis will be the next test for both results.