AI Just Found Cryptography Weaknesses Experts Missed: What It Means for Your Business

AI Just Found Cryptographic Weaknesses That Experts Missed — Here's What It Means for Your Business

On 28 July 2026, Anthropic published something that would have sounded like science fiction a year ago: an AI model, working largely on its own, discovered two brand-new weaknesses in cryptographic algorithms — including a flaw in a post-quantum scheme that human experts had reviewed for two years without spotting. If you run a business, the practical takeaway is reassuring but important: nothing you use today is broken, and no software you rely on needs to change. What changed is the direction of travel — AI is now a serious tool for both attacking and defending encryption, and that makes "crypto-agility" and post-quantum planning worth putting on your roadmap.

What Anthropic actually announced

Using a model called Claude Mythos Preview, Anthropic's researchers ran two cryptanalysis projects. In the first, the model found a structural flaw in HAWK, a candidate for future post-quantum digital-signature standards under NIST. In the second, it invented a new attack technique — which it named the "Möbius Bridge" — that speeds up an existing attack on a deliberately weakened version of the AES cipher. Each result took the model a matter of days and cost roughly $100,000 in API usage to develop. Crucially, Anthropic followed responsible disclosure: it consulted academics, shared the HAWK attack with that scheme's authors in June, and coordinated with NIST plus government and industry partners before going public.

The HAWK post-quantum flaw, in plain terms

HAWK is a proposed algorithm for digital signatures designed to stay secure even against future quantum computers. Its security rests on a hard math problem (the Lattice Isomorphism Problem). The model discovered a hidden symmetry in that lattice — a "nontrivial automorphism" — that earlier researchers suspected could exist but had never found. That symmetry enables a faster attack and roughly halves the effective key strength. For the small research parameter HAWK-256, the estimated attack cost dropped from 2^64 to 2^38. The larger, real-world parameter sets (HAWK-512 and HAWK-1024) remain impractical to break. And because HAWK is still a candidate under NIST review — not deployed anywhere — the discovery is exactly the kind of stress-testing the standardization process is meant to catch.

The Möbius Bridge attack on AES — and why "7 rounds" matters

AES is the encryption standard that protects most of the data moving through browsers, banking apps, and encrypted drives. Full AES-128 runs ten internal "rounds." The model's Möbius Bridge technique attacks a reduced, seven-round research variant and makes an existing attack between 200 and 800 times faster. That sounds dramatic, but read the fine print: it does not break real AES. The full ten-round cipher you use every day is untouched, and even the seven-round attack remains, in Anthropic's words, "completely impractical." Attacking reduced-round variants is a normal way cryptographers measure a cipher's safety margin — and here that margin held.

Why nothing you use today is broken

This is the line to remember, straight from Anthropic: "neither of these results has a practical impact on today's computer systems; no production software will have to change as a result." HAWK is not in production. The AES result targets a weakened variant, not the cipher securing your traffic. So there is no patch to rush and no system to replace. What you are seeing is a preview of how security research will work from now on.

What this really means for your business

The headline isn't "encryption is broken." It's "the pace of discovery just changed." Anthropic itself predicts that AI will soon generate cryptographic findings faster than human researchers can validate them. For a business, that has three practical consequences. First, the window between a weakness being found and being exploited will keep shrinking, so your ability to patch and rotate keys quickly matters more than ever. Second, the same tools that find flaws can harden your systems — expect AI-assisted security audits to become standard. Third, the long-planned migration to post-quantum cryptography is no longer a distant academic exercise; the ground is moving, and organizations that know where they use encryption will adapt far faster than those that don't.

A practical readiness checklist

• Inventory your cryptography. Know where you rely on encryption and signatures — TLS on your websites and APIs, data at rest, VPNs, document signing, and payment flows.
• Design for crypto-agility. Build systems so an algorithm can be swapped without re-architecting the whole product. This is the single most valuable habit right now.
• Plan the post-quantum path. Track NIST's post-quantum standards and start pilots for high-value, long-lived data — anything an attacker could "store now and decrypt later."
• Keep patching disciplined. Faster discovery means faster response; make key rotation and dependency updates routine, not emergencies.
• Tie it to compliance. Strong, current encryption is a core control under Saudi Arabia's PDPL and data-protection expectations — treat it as an ongoing program, not a one-time setup.

How Origami approaches this

At Origami we build software with security as a design constraint, not an afterthought. That means crypto-agile architectures, sensible key management, dependency monitoring, and systems documented well enough that a future algorithm swap is a configuration change rather than a rewrite. As AI reshapes both offense and defense in security, our job is to keep your systems on the defending side of that line — current, auditable, and ready to adapt. If you want a clear picture of where your business uses cryptography and how ready you are for what's coming, that is exactly the kind of review we help Saudi organizations run.

Sources

• Anthropic — "Discovering cryptographic weaknesses with Claude": anthropic.com
• NIST — Post-Quantum Cryptography project: csrc.nist.gov