AI doing cryptanalysis: what Anthropic's result means for you

A quiet milestone just happened at the frontier between artificial intelligence and cryptography, and it deserves the attention of anyone who handles security, without the panic that headlines about "AI breaking encryption" tend to trigger. Anthropic announced that a preview model largely conducted, on its own, two cryptanalysis efforts: it derived a full key-recovery attack against HAWK-256, a post-quantum signature scheme, and found a 200x to 800x speedup on an attack against AES-128 reduced to seven rounds. It is worth understanding exactly what this is, what it is not, and why it changes how we think about defense going forward.

What actually happened

In the HAWK case, the AI found a previously unexploited symmetry in the mathematical structure (the lattice) behind the scheme. With it, the estimated work factor to recover the HAWK-256 key dropped from 2^64 to 2^38. Anthropic published the code, two technical papers and reproducibility artifacts, and says the model developed and verified the result over roughly 60 hours in a multi-agent environment, with a human researcher providing project direction but who was not a lattice-cryptography specialist.

In the AES case, the AI created a technique it nicknamed the Möbius Bridge, an invariant "fingerprint" that removed a 256-way trial-and-error step from a known attack, making it 200x to 800x faster in the seven-of-ten-rounds version of the algorithm.

What this does NOT mean (read before panicking)

Here is the part that separates analysis from sensationalism. Anthropic itself is emphatic: no production system needs to change because of these results.

• HAWK-256 is a challenge parameter, created precisely to serve as a cryptanalysis target, not the real security parameters (HAWK-512 and HAWK-1024), which remain impractical to attack.
• The AES attack covers 7 of the 10 rounds and requires an unrealistic number of chosen plaintexts (around 2^105). The full AES protecting your data today remains intact.
• Neither attack is a polynomial-time break. They remain exponential and do not extend to lattice cryptography in general.

In other words: your TLS, your VPN, your encrypted disks and your backups did not become vulnerable this week. Anyone saying otherwise is selling fear.

So why does it matter for your company?

Because the long-term signal is real, even if the immediate impact is zero. Three concrete lessons:

• Cryptanalysis gained a new kind of researcher. Studying reduced-round ciphers (like 7-round AES) is standard practice to measure how much safety margin remains before an attack reaches the full construction. Having an AI able to shorten that margin, and to find symmetries that got past human experts, changes the pace at which theoretical weaknesses can emerge. The cycle between "academic discovery" and "practical risk" tends to shorten.
• Crypto-agility went from concept to requirement. If algorithms can have their margins reviewed faster, your organization needs to know where it uses each cryptographic primitive and be able to swap it without rewriting everything. This is doubly true with the ongoing post-quantum transition: inventorying what you use today is the first step to not being caught off guard tomorrow.
• Human verification remains the bottleneck, and the differentiator. A telling detail: the experiment's API cost was around US$ 100k, but two researchers took almost a month to be confident the result was correct. The AI sped up discovery; specialist validation is what made the result trustworthy. This is exactly the model we advocate for AI-assisted offensive security.

How Intelliway reads this move

This result reinforces the thesis behind our ISA Horizon: AI for breadth and speed, human specialists for depth and judgment. A tool that finds an attack path does not replace whoever confirms whether it is exploitable in your environment, and at what cost. It is the same logic we apply in our SOC AI-Driven and MDR: AI agents covering scale and the 24/7 operation, analysts validating what actually requires action.

For most companies, the right attitude now is not to swap cryptography in a hurry, but to gain visibility: map where your keys and algorithms are, prioritize crypto-agility and follow the post-quantum transition with a partner who understands both the math and the operation. It is this groundwork that turns a scary headline into a preparedness advantage.

Want to assess your cryptographic posture and your readiness for the post-quantum era with a partner that unites Cybersecurity and AI? Talk to our team and get to know ISA Horizon.