Claude finds a real attack on HAWK, and the NIST forum verifies it

A new attack, announced on the record

On 28 July 2026, a message landed on pqc-forum, the mailing list NIST uses to run its post-quantum standardization in the open. The author was Steve Weis, and the subject line was blunt: "HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1."

"We would like to announce an improved key recovery attack against HAWK-n that reduces to SVP in dimension n/2 + 1," the message read. It pointed to a paper at anthropic.com and to an accompanying blog post, and it put numbers on the claim. "In the gate-count model of AGPS'20, the improved attack lowers the key-recovery cost of HAWK-512 from 2^150 to 2^108 and of HAWK-1024 from 2^288 to 2^182." To show the attack was more than arithmetic on a whiteboard, the announcement added: "We demonstrate this with a practical implementation that recovers a HAWK-256 secret key end-to-end in a few hours on a single server," with the code posted on GitHub.

There was one more line, and it is the reason the announcement traveled well beyond the usual lattice-cryptography audience. "We would also like to acknowledge that this was found by Claude, with minimal technical guidance from people."

What HAWK is, and what actually broke

HAWK is a digital signature scheme, one of the candidates still standing in NIST's call for additional post-quantum signatures. It was designed by Leo Ducas, Eamonn W. Postlethwaite, Ludo N. Pulles, and Wessel van Woerden, and its selling point is speed and simplicity: built on the module Lattice Isomorphism Problem, it reuses ideas from NTRUSign and Falcon while dropping the floating-point Gaussian sampling that makes Falcon awkward to implement. Signing is several times faster than Falcon, with signatures that are somewhat smaller. That combination is exactly why people were paying attention to it.

The attack exploits a previously unknown symmetry in HAWK's lattice, a nontrivial automorphism that earlier theoretical work had predicted could speed up attacks without anyone having found one in HAWK's actual structure. Using it, the key-recovery problem collapses from the full lattice dimension to roughly half of it, which is what "SVP in dimension n/2 + 1" means.

What did not happen is as important as what did. The security parameter sets, HAWK-512 and HAWK-1024, are not practically broken. Their costs drop to 2^108 and 2^182 in the gate-count model, lower than advertised but still firmly exponential and far out of reach. The end-to-end key recovery that runs "in a few hours on a single server" was against HAWK-256, the smallest toy parameter, where halving the dimension is enough to finish the job. Anthropic's own writeup is careful on this point: "neither of these results has a practical impact on today's computer systems; no production software will have to change as a result." HAWK is a candidate, not a deployed system.

The blast radius is narrow by construction. "This result does not impact Falcon, ML-DSA, or other latticed-based schemes," the pqc-forum message said, and the blog repeats it: "It is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general." The weakness lives in HAWK's particular lattice symmetry, not in lattice signatures as a family.

The forum did what the forum is for

The value of announcing an attack on pqc-forum is that other cryptographers can check it in public, and that is what happened. Daniel Apon, a cryptographer long involved in the NIST process, replied within the hour. "Nice," he wrote. "It checks out independently for me."

That single line is the part a reader should weigh most heavily. The validity of the mathematics does not depend on who or what produced it; it depends on whether it survives review, and the first independent look says it does. Anthropic also says it shared the attack with the HAWK authors in June, coordinated the public disclosure with NIST, consulted academics to verify the findings, and gave advance copies to government and industry partners. In the announcement, the company thanked "the HAWK team for their help verifying this result and for their feedback." This is the standardization process working as intended. As the blog notes, "during NIST's standardization of ML-KEM and ML-DSA, several of the competing proposals were shown to be insecure." Finding cracks in candidates is the point of having candidates.

The claim that will get argued about

The technical result is checkable. The provenance claim is the one that will generate the longer thread, because Anthropic is not describing a person who used a model as a calculator. It is describing the model as the one who found the attack.

According to the writeup, one researcher, with a theoretical computer science background but no lattice-cryptography expertise, worked with the model, identified as Claude Mythos Preview, for about a week inside a Claude Code style harness running several worker agents with access to Python, the Sage computer-algebra system, and the published literature. "Mythos Preview achieved these results mostly autonomously and mostly without human intervention," the company writes, with human input limited to project management rather than mathematics.

The most concrete anecdote is about two agents disagreeing. "Both started investigating the idea; the first worker prematurely rejected the idea as infeasible, but the second found a way to fully exploit it," the blog says. "The pair kept exchanging messages, and eventually both agreed they had found an effective attack." The bill for that week of work is stated plainly: "Finding, developing and verifying the attack took about 60 hours in total. We estimate that the full attack discovery process cost approximately $100,000 in API cost."

Two caveats keep the story honest. First, "mostly autonomously" is a hedge, not a claim of full autonomy, and the model was pointed at a scheme already flagged in prior work as having the kind of symmetry that might be exploitable. Second, the machine's 60 hours were not the end of the work. Turning a claimed attack into something publishable, checked, and disclosed took human researchers, by the company's own account, several hundred additional hours. The discovery may have been fast and cheap; the verification that made it trustworthy was neither.

Why it matters anyway

Strip away the novelty and a solid result remains: a genuine, independently confirmed cryptanalytic improvement against a real NIST candidate, reducing its security margin and fully recovering a key at the smallest parameter set. That would be a good week for any cryptanalysis group.

The novelty is that the group was mostly a model. Cryptographers have spent a long time treating machine-generated proofs and attacks as things to be checked skeptically, and nothing here changes that discipline; Apon still had to confirm the math, and the HAWK authors still had to sign off. But the cost curve is the uncomfortable part. If a symmetry that survived years of expert scrutiny can be surfaced in 60 hours for roughly the price of a conference sponsorship, the assumption that a scheme is safe simply because clever people looked at it and found nothing gets weaker. The NIST process assumes candidates will be attacked hard before they are standardized. It now has a new and tireless class of attacker, and the responsible thing, which Anthropic did here, is to run those attacks through the same public forum everyone else uses and let the math be checked in the open.