Anthropic says its Mythos model found vulnerabilities in cryptographic algorithms that secure the internet Anthropic称其Mythos模型发现加密算法漏洞，这些算法保护着互联网安全

TL;DR

• Anthropic's Claude Mythos Preview AI model discovered mathematical weaknesses in cryptographic algorithms, including a reduced version of AES and the post-quantum signature scheme HAWK.
• The model developed two attacks independently in a multi-agent system, with one attack on HAWK found in 60 hours for approximately $100,000 in API costs.
• While neither finding affects current systems (HAWK is still a NIST candidate and the AES attack applies to a modified 7-round version), this demonstrates AI's potential to challenge core internet security assumptions.
• Human researchers provided minimal prompting and project management, while primarily verifying results after the AI generated hypotheses through experiments.
• Anthropic coordinated disclosure with relevant parties and created a new benchmark called CryptanalysisBench to evaluate language models' cryptanalytic abilities.

Why It Matters

This development represents a significant milestone in AI's capability to perform complex mathematical reasoning that traditionally requires specialized human expertise. For cybersecurity professionals and AI researchers, it highlights both the potential risks of advanced AI systems breaking encryption standards and opportunities for using AI to proactively identify vulnerabilities before malicious actors exploit them. The findings underscore the need for continued collaboration between AI developers and cryptographers as these technologies advance.

Technical Details

• Claude Mythos Preview worked semi-autonomously in a multi-agent system where one agent initially dismissed an approach as infeasible while another successfully exploited it
• For HAWK, the attack exploited a previously undetected symmetry in the mathematical lattice structure that underpins the scheme's security
• The AES attack used a novel "Möbius Bridge" fingerprinting method that improved upon previous attacks by factors of 200-800 by removing one required guess from attackers
• The model generated several hundred million tokens over three days with only three substantive human prompts during the AES investigation
• Researchers who weren't cryptography experts spent hundreds of hours verifying the AI-generated findings
• Anthropic collaborated with ETH Zurich, Tel Aviv University, and University of Haifa to develop CryptanalysisBench for systematic evaluation of language models' cryptanalytic capabilities

Industry Insight

The rapid discovery of cryptographic weaknesses by AI suggests that security protocols may need more frequent automated auditing than traditional manual review processes allow. Organizations should consider integrating AI-assisted cryptanalysis into their security testing frameworks while maintaining rigorous human verification processes. As AI capabilities continue advancing, we can expect increasingly sophisticated automated vulnerability discovery that will necessitate proactive rather than reactive approaches to cryptographic standardization and implementation.

TL;DR

• Anthropic的Claude Mythos模型在独立运行下发现了HAWK后量子签名方案和简化版AES加密算法中的数学弱点。
• Mythos通过多代理系统以约10万美元API成本分别攻破HAWK（耗时60小时）和AES-128缩减轮次版本，其中AES攻击方法"Möbius Bridge"将破解效率提升200-800倍。
• 人类研究者仅负责项目管理、基础提示词提供及结果验证，未参与核心密码学分析过程。
• 两项发现均不影响当前实际部署系统（HAWK尚处NIST标准化候选阶段，AES攻击针对7轮而非完整10轮方案）。
• Anthropic联合学术机构发布CryptanalysisBench基准测试工具，推动AI密码分析能力评估标准化。

为什么值得看

该案例标志着AI自主密码分析能力的实质性突破，展示了大模型在无需领域专家深度介入情况下可独立完成高难度安全漏洞挖掘，对传统密码学研究范式构成挑战。同时揭示了AI驱动的安全风险可能加速现有加密体系迭代压力，为行业提前布局抗量子防御与AI安全治理提供关键实证依据。

技术解析

• HAWK攻击机制：Mythos识别出HAWK方案数学格结构中未被发现的对称性缺陷，通过多代理协作（一代理否定可行性、另一代理构建 exploit路径）实现60小时内完成人类两年审查未发现的问题，API消耗约$100,000生成数亿tokens。
• AES-"Möbius Bridge"方法：模型自主设计新型指纹消除技术，移除攻击者需猜测的关键参数维度，使破解复杂度较最优已知方案降低200-800倍；初始因认为"改进无望"拒绝任务，经提示词引导转向"真正新颖思路"后才突破。
• 人机协作模式：研究者设定实验框架并注入3次核心指令（如"寻找非显而易见成果"），模型自主执行超10亿token推理链，人类非密码学背景团队耗时数百小时验证数学正确性。
• 安全边界控制：所有发现提前同步美国政府及产业伙伴，HAWK漏洞与原始作者协调披露，Model Preview版本严格限制公众访问，体现负责任的漏洞管理流程。
• 评估工具开发：联合苏黎世联邦理工学院等机构创建CryptanalysisBench基准，提供系统化语言模型密码分析能力测试框架，支持后续研究可比性验证。

行业启示

• 加密体系加速演进压力：AI自主破解能力可能缩短传统算法安全寿命周期，建议NIST等标准组织将AI抗性纳入后量子密码选型权重，企业需提前规划密钥迁移策略。
• AI安全双刃剑效应凸显：同等技术既可赋能漏洞挖掘也可用于自动化攻击，应建立AI密码分析工具的分级授权机制，同时推动"红队测试"成为AI模型上线前的强制安全环节。
• 跨学科研究范式变革：证明非密码学背景的AI研究者可通过自主探索解决专业难题，鼓励设立AI+密码学交叉实验室，但需配套建立自动化验证与人工复核双重质量控制流程。