Claude Mythos Preview finds new ways to attack weakened encryption

In short: Anthropic says Claude Mythos Preview helped researchers find faster attacks on weakened or experimental encryption, and it also found real software bugs, but today’s mainstream encryption is not suddenly unsafe.

What happened

Anthropic tested a research system called Claude Mythos Preview on cryptography, which is the math and software used to lock up data so only the right people can read it.

In one set of results, the system found better attacks on the algorithms, meaning the math itself. It produced a stronger attack on HAWK, an experimental “post-quantum” digital signature design (a way to prove a message is authentic, built to resist future quantum computers). HAWK is not widely used in everyday products, so this does not directly put bank logins or popular messaging apps at risk.

It also attacked “round-reduced” AES. AES is the standard lock used across much of the internet, like the main kind of padlock used on many doors. Researchers often test a deliberately weakened version with fewer steps, like practicing on a training lock with fewer pins. Mythos found a new method that sped up attacks on one such weakened AES version by about 200 to 1,000 times, but Anthropic and outside reporting say this does not apply to the full AES used in real systems today.

In a second set of results, Mythos found implementation bugs, meaning mistakes in the code that uses encryption. Reports describe issues in software used for TLS (the system behind HTTPS website locks), AES-GCM (a common way to encrypt and also detect tampering), and SSH (secure remote login). Some bugs could allow forged certificates (fake ID cards for websites) in specific libraries if unpatched.

Why it matters

These findings do not mean “online banking encryption is broken.” They do show that advanced AI can help find weaknesses faster, especially software mistakes, which makes quick updates and responsible patching more important.

Source: NYTimes