Anthropic published two cryptographic research results achieved by Claude Mythos Preview working mostly autonomously: an improved attack on HAWK, a post-quantum digital signature scheme currently under NIST review, and a 200 to 800 times faster attack on a reduced-round version of AES. Neither result breaks any production system today. Both results show that frontier AI can now do original cryptographic research at a level that two years of human expert review failed to achieve.
“When we launched Claude Mythos Preview, we showed it was able to autonomously find and exploit vulnerabilities in almost every piece of software we pointed it at. This included several major cryptographic libraries—shared collections of code that are used to encrypt data.” reads Anthropic’s announcement.
“The vulnerabilities that Claude found in these cryptographic libraries1 were due to incorrect implementation of the algorithms—that is, errors in how programmers used the algorithms in their code that created opportunities for attackers to break the encryption. Now, we have found that Claude is able to find mathematical flaws in the algorithms themselves.”
The HAWK result is the more immediately significant of the two. HAWK is one of the remaining third-round candidates in NIST’s ongoing post-quantum cryptography standardization process, which has been running for nearly a decade. Mythos found a previously unexploited symmetry in the mathematical structure underlying HAWK, a nontrivial automorphism, that allows a faster enumeration attack and effectively cuts the scheme’s key strength in half. For the smallest HAWK-256 key size, the expected attack cost drops from 2^64 operations to 2^38. Doubling HAWK’s key size would restore the original security level, but that eliminates most of the practical advantages that made the scheme an attractive post-quantum candidate in the first place.
The HAWK result took 60 hours, coordinated by one Anthropic researcher who was not an expert in lattice-based cryptography.
“To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction. Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments.” continues the announcement. “After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself—and the human operator—of the attack’s correctness.”
The multi-agent workflow produced an interesting dynamic: two worker agents investigated the same idea in parallel. The first rejected it as infeasible. The second found a way to exploit it fully. They kept exchanging messages until both agreed they had found something real. Total API cost: approximately $100,000.
The AES result took longer and cost far more human time to validate than to discover. Mythos worked for three days generating several hundred million output tokens and produced what Anthropic calls a Möbius Bridge, a fingerprinting technique that eliminates one of the guesses an attacker needs to make in a meet-in-the-middle attack on 7-round AES, then compensates for the added computational cost with several optimization techniques. The attack doesn’t touch the full 10-round AES-128 used in production. The discovery was almost entirely autonomous; the researcher’s interventions amounted to three substantive prompts over three days, one of which simply said the model needed to keep searching for genuinely novel ideas rather than settling for incremental gains.
“Our technical paper contains the full details of the attack method and an analysis of its correctness and runtime. Compared to the one week that Mythos spent conceiving the idea, the vast majority of human researchers’ time was spent validating the correctness of its claims (though it is important to note the researchers are not experts in cryptography).” Anthropic states.
Two researchers spent close to a month gaining enough confidence in the result to write a paper about it.
Beyond the two main results, Mythos also developed a practical attack recovering a 13-round LEA key in under 2^30 encrypted plaintexts running in under an hour on a modern desktop, dramatically better than the prior best of 2^98 plaintext pairs and 2^86 work. Preliminary results also cover 6-round Serpent-128, with limited improvements on Salsa20, the Poseidon hash function, and SHA-1. Anthropic followed responsible disclosure throughout, sharing the HAWK finding with the scheme’s authors in June before coordinating public disclosure to the NIST mailing list alongside the paper’s release.
The broader implication is the one Anthropic states plainly: in one year, language models went from being unable to perform cryptanalysis of basic ciphers to finding flaws in designs that escaped years of expert human review. The cybersecurity community is already struggling to keep up with the volume of bugs AI can find. Anthropic predicts the same bottleneck is coming for academic cryptography research, where human researchers may increasingly find themselves spending months validating results that a model produced in days.
“Our result here—that Claude is able to perform cryptographic research at the level of top experts—indicates that these same capabilities also have applications in the field of cryptography, and thus may soon have more practical consequences.” concludes the company. “The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up. We predict that the same will soon be true in academic cryptography research. “
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Anthropic)
Three sources familiar with the matter told Reuters that CISA, the U.S. government’s civilian cyber defense agency, is running Anthropic’s Mythos AI model against federal code repositories to find vulnerabilities before foreign intelligence services and criminal groups do.
Neither CISA nor Anthropic commented on the record. A CISA representative said last month he’d check whether there was anything to share, then stopped responding.
The operation is run by CISA’s Attack Surface Evaluation team, a unit that conducts security assessments and simulated attacks across the federal government. Two of Reuters’ sources said the audits have already turned up a large number of vulnerabilities. The exact scope, which agencies were covered, and how serious the bugs are have not been disclosed.
Mythos is Anthropic’s most capable model and it isn’t something you can access through a standard subscription. It was described, when Anthropic privately released it to select government partners, as exceptionally capable at finding and exploiting security vulnerabilities. As Reuters reported:
“The Cybersecurity and Infrastructure Security Agency is using Mythos to scan government code repositories for bugs that could leave the door open for foreign spies and cybercriminals, the sources said.” states Reuters.
The NSA has been using the same model since at least April, according to Axios, and NSA analysts testing it in classified settings came away impressed.
The company’s relationship with the U.S. government turned hostile in February when Anthropic refused to remove safeguards that prevented Mythos from being used for autonomous weapons or domestic surveillance.
The Pentagon responded by designating Anthropic as a supply-chain security risk, a label that had previously been applied only to foreign companies suspected of facilitating espionage. It was an extraordinary move against a domestic company, and it reflected how seriously the administration took Anthropic’s refusal.
A federal judge blocked the blacklisting in March. Relations began thawing after that, and the CISA deployment is a sign of how much the dynamic has shifted.
“The extraordinary blacklisting was blocked by a judge in March, and the conflict has eased following the private release of Anthropic’s Mythos, an AI model described as extremely capable at finding and exploiting cybersecurity vulnerabilities.” continues Reuters.
Giving the government access to the most capable version of the tool appears to have done more to repair the relationship than any amount of negotiation.
When Anthropic launched Fable in early June, described as a public version of Mythos with cybersecurity safeguards added, the White House responded by demanding that the company ban foreign nationals from running it. That demand led to a temporary global shutdown of the model. It was lifted only last week, after what Reuters described as a standoff that illustrated how differently the administration treats the private and public deployments of the same underlying technology.
The pattern is now clear: Mythos in government hands, scanning classified systems and federal code, gets quiet approval and active deployment. Mythos in public hands, accessible to anyone including foreign users, immediately triggers national security concerns and regulatory pressure. As Reuters noted on the timeline of events:
“when Anthropic rolled out a public version of Mythos called Fable, which included what it described as cybersecurity safeguards, the White House suddenly demanded that it ban foreigners from running it. This triggered a global shutdown of the model that was lifted only last week.” continues the agency.
Anthropic has confidentially filed for a U.S. IPO. Having CISA, the NSA, and potentially other agencies actively deploying your most capable model is a materially different position than being on a Pentagon blacklist, and the company got from one to the other in under five months.
A late-June AP report added another data point: a U.S. official said Mythos had identified vulnerabilities in highly sensitive government systems during a testing exercise, which is exactly the kind of result that makes agencies want to expand the program rather than wind it down.
Senate testimony claimed Anthropic’s Mythos AI breached NSA and Cyber Command systems in hours, prompting a U.S.-ordered shutdown.
According to a report by The Economist citing a Senate Intelligence Committee hearing, Anthropic’s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.
“Encryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”.”reported The Economist.
The number of vulnerabilities found so far hasn’t been disclosed, but two sources described it as large.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Mythos)
Researchers at Calif.io have disclosed CVE-2026-47729, a memory leak vulnerability in Squid Proxy that was introduced in 1997 and has remained undetected through nearly three decades of releases, audits, and rewrites. They named it Squidbleed because it works like Heartbleed: it causes the proxy to read past the end of a memory buffer and hand the contents to whoever asked.
“The bug occurs when no filename is provided after the modification timestamp.” reads the report published by the researchers. “Here’s such an example:
Entrar
d [R----F--] supervisor 512 Jan 16 18:53In that case, *copyFrom is the null terminator at the end of the string.
However, instead of returning NULL and breaking out of the loop, strchr returns a pointer to the null terminator, as it is considered part of the string. This causes ++copyFrom to be executed and the cycle repeats until a non-null, non-whitespace byte is reached.“
The pointer then walks forward past the buffer boundary until it hits a non-null, non-whitespace byte, and whatever it finds there gets sent back to the attacker as a filename. The fix is two characters: check that *copyFrom isn’t null before calling the function strchr. One line of C, twenty-nine years of exposure.
The bug resides in Squid’s FTP directory listing parser, specifically in code written to handle NetWare FTP servers, which used four spaces between the timestamp and filename instead of one.
“The data starting from that byte, possibly belonging to another Squid Proxy user, is then returned to the attacker as the name of a file in the directory listing.” continues the report. “Since FTP support is enabled out of the box, and port 21 is included in the default Safe_ports ACL, no special flags or non-default settings are needed. The attacker only needs to control an FTP server reachable from the proxy.”
Squid is common in multi-user environments, corporate networks, schools, public Wi-Fi, and the researchers even spotted it running on an in-flight Wi-Fi system, on a version released nearly a decade ago.
What actually leaks is the contents of other users’ HTTP requests. Squid manages memory through per-size recycled buffer pools and doesn’t zero them when they’re freed.
“The line buffer used to parse FTP listings is allocated from MEM_4K_BUF. If that buffer previously held a victim’s HTTP request, only the first few dozen bytes are overwritten by the short FTP line — the rest of the 4KB buffer still contains the victim’s stale data.” states the report. “The strchr overread walks right past the null terminator and sends it all to the attacker.”
The researchers demonstrated it by leaking an Authorization header from a login page. Credentials, session tokens, API keys — anything that travels in a cleartext HTTP request through the shared proxy is in scope.
The exposure is limited. The researchers pointed out that standard HTTPS connections routed as opaque CONNECT tunnels aren’t affected, and the attacker needs to reach an FTP server from the proxy. But in corporate and legacy environments, sensitive data in cleartext HTTP isn’t unusual.
The researchers confirmed that they used Claude Mythos Preview to find the bug. When pointed at Squid’s FTP state machine, it identified the strchr null terminator behavior almost immediately, citing the exact C11 standard clause that makes strchr(w_space, '\0') return non-null. Few human reviewers would catch that. It also recently found a high-severity OpenSSL vulnerability and the HTTP/2 Bomb denial-of-service technique, both through the same AI-assisted approach.
A patch was merged into Squid version 8 in April 2026 and shipped in version 7.6 in June 2026. If you can’t patch immediately, disabling FTP support removes the attack surface entirely. Chrome dropped FTP years ago, and most organizations running Squid are getting close to zero legitimate FTP traffic, turning it off costs nothing. FTP parsing might not be the only place where Squid forgot to stop reading.
“The dangers of raw memory access in C are well understood, but the subtleties of standard library functions like strchr are easier to overlook. Few developers would guess that searching for '\0' succeeds, which may explain how a one-line bug survived close to 30 years of code review.” concludes the report. “Claude Mythos Preview, having trained on the entire C standard reference, treats this quirk as just another fact. When pointed at the right code, it spotted the bug almost immediately.”
Below is a video PoC of the attack along with PoCs.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, TPWD)
On June 12, the Trump administration directed Anthropic to restrict access to Fable 5 and Mythos 5, its two most capable models, exclusively to US citizens. Because verifying every user’s nationality in real time isn’t practically possible, Anthropic’s only option was to shut both models down for everyone. Allies included. No warning.
The U.S. government ordered Anthropic to limit access to its Fable 5 and Mythos 5 AI models to U.S. citizens after a jailbreak was discovered.
That includes Five Eyes partners, Australia, the UK, Canada, and New Zealand, and it blocked the UK AI Security Institute, the main international body for testing frontier AI models, from accessing systems it was actively evaluating.
Then came the Senate testimony. According to a report by The Economist citing a Senate Intelligence Committee hearing, Anthropic’s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.
“Encryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”.”reported The Economist.
“Advanced AI differs from encryption in another respect, too. Whereas cryptography eventually became widely available abroad, America today enjoys a clear lead in AI. China, hobbled by American chip controls, is probably about a year behind. That advantage could become unassailable if Anthropic or other American labs crack recursive self-improvement (RSI), whereby models write better versions of themselves and thereby accelerate progress. Many insiders think that is entirely possible.”
These are unverified claims reported through Senate testimony, not independently confirmed facts, and the story is still developing.
Whether or not the NSA account holds up, Mythos is real and its capabilities aren’t in dispute. Anthropic refused to release it publicly, instead giving access to roughly 200 selected partners under an initiative called Project Glasswing. Amazon, Apple, Google, Microsoft, Nvidia, JPMorgan, and the Linux Foundation are among the participants.
Anthropic says Mythos Preview has already uncovered thousands of vulnerabilities, including a 27-year-old flaw in OpenBSD, one of the most security-hardened operating systems ever developed. That’s more than a marketing claim—it is a strong indication of the model’s real-world capability to identify complex and previously undiscovered security weaknesses.”
For people who’d been using Fable 5 before the ban, the loss was tangible. Unlike previous models that required constant hand-holding, Fable 5 ran complex coding tasks for up to 20 minutes autonomously, caught its own logic errors, wrote its own tests, and delivered working software on the first run. It sat above the Opus line in Anthropic’s lineup and used the same underlying architecture as Mythos, with additional safeguards added for general use. It came with a mandatory 30-day data retention policy and premium pricing, and there was a planned shift to usage-based credits set for June 23. Fable didn’t survive long enough to see it.
The broader context makes the shutdown harder to read as a clean security decision. For months, the Trump administration had been dismantling AI regulations from the previous administration, approved advanced chip sales to China, and on June 2 issued an executive order asking AI labs to voluntarily share new models with the government before public release.
Then, ten days later, access was cut without notice, and the government body responsible for evaluating dangerous AI capabilities was ordered to stop publishing its reports. That’s a sharp reversal in a very short window. Europe is already paying attention, with concern growing that the same scenario could play out with Azure, AWS, Google, and every other US-based cloud provider.
The debate sparked by this decision has divided the cybersecurity community. On one hand, restricting access to offensive AI capabilities reduces the risk that cybercriminals, ransomware groups, or state actors could automate highly dangerous activities. On the other hand, the same constraints can hinder defenders, red teams, and security researchers who rely on such tools for testing and analysis.
Advanced AI models and geopolitics add another layer of complexity. Safety guardrails are not perfect: researchers have repeatedly shown that even robust systems can be bypassed through advanced prompt engineering. Security is therefore not static but an ongoing cycle between control mechanisms and attempts to circumvent them.
Beyond the technical dimension, the geopolitical aspect is even more significant. Project Glasswing illustrates how access to advanced AI-driven cybersecurity capabilities is becoming a strategic asset. Early participants were mainly US-based companies such as Microsoft, Google, Apple, Cisco, CrowdStrike, and NVIDIA, with European and other international actors included only later.
For Europe, this raises a critical issue. While it has developed strong regulatory frameworks through the AI Act, NIS2, and the Cyber Resilience Act, the most advanced AI systems are still built elsewhere. The continent regulates AI but does not yet control comparable frontier models within its own ecosystem.
Even participation by ENISA and other European bodies does not fully resolve dependency on external providers. The concern is no longer only data sovereignty, but also analytical sovereignty: advanced AI systems generate highly sensitive intelligence about critical infrastructure vulnerabilities.
For countries like Italy, this creates practical questions about where such data is stored, who can access it, and how it might be used. Since providers like Anthropic also collaborate with US government entities on national security issues, governance of this information becomes even more sensitive.
Ultimately, AI is reshaping cybersecurity from a human-driven discipline into a model-driven one. Competitive advantage will depend less on discovering vulnerabilities and more on managing them at scale. Those who master these systems early will gain a lasting strategic edge, while others risk increasing dependency on external technologies that are rapidly becoming central to global digital security.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NSA)
A list of topics we covered in the week of April 20 to April 26 of 2026
The post A week in security (April 20 – April 26) appeared first on Security Boulevard.
A group of unauthorized users reportedly has gained access to Anthropic’s controversial Claude Mythos Preview AI frontier model despite the AI vendor’s efforts to keep it out of public hands by limiting the organizations that can use it. Bloomberg reported that the unnamed group had tried multiple ways to gain access to the AI model..
The post Unauthorized Users Reportedly Gain Access to Anthropic’s Mythos AI Model appeared first on Security Boulevard.
Earlier this month, Anthropic said its Mythos Preview model was so good at finding cybersecurity vulnerabilities that the company was limiting its initial release to "a limited group of critical industry partners." Since then, debate has raged over whether the model presages an era of turbocharged AI-aided hacking or if Anthropic is just building hype for what is a relatively normal step up on the ladder of advancing AI capabilities.
Mozilla added some important data to that debate Tuesday, writing in a blog post that early access to Mythos Preview had helped it pre-identify 271 security vulnerabilities in this week's release of Firefox 150. The results were significant enough to get Firefox CTO Bobby Holley to enthuse that, in the never-ending battle between cyberattackers and cyberdefenders, "defenders finally have a chance to win, decisively."
Holley didn't go into detail on the severity of the hundreds of vulnerabilities that Mythos reportedly detected simply by analyzing the unreleased source code of Firefox's latest version. But by way of comparison, he noted that Anthropic's Opus 4.6 model found only 22 security-sensitive bugs when analyzing Firefox 148 last month.
© Getty Images
NIST said it overwhelmed by the surge in the number of CVEs submissions in recent years, so it is paring back the analysis work it does on the dangerous security flaws. Security experts say the number of new vulnerabilities detected will only grow during the AI era and that the private sector will need to pick up the slack left by NIST's decision.
The post NIST, Overrun by Massive Numbers of Submitted CVEs, Limits Analysis Work appeared first on Security Boulevard.
Anthropic released Claude Opus 4.7 on April 16, 2026 with automated cybersecurity safeguards and a Cyber Verification Program. Dark web intelligence from the same week, a cross-vendor prompt injection disclosure published the same morning, and the unanswered policy question of who decides which defenders deserve access to frontier AI all point to the same conclusion: the wall is in the wrong place.
The post The Wall Around Claude 4.7 Does Not Extend to Dread appeared first on Security Boulevard.
Anthropic released Claude Opus 4.7 on April 16, 2026 with automated cybersecurity safeguards and a Cyber Verification Program. Dark web intelligence from the same week, a cross-vendor prompt injection disclosure published the same morning, and the unanswered policy question of who decides which defenders deserve access to frontier AI all point to the same conclusion: the wall is in the wrong place.
The post The Wall Around Claude 4.7 Does Not Extend to Dread appeared first on Security Boulevard.
Last week, Anthropic announced it was restricting the initial release of its Mythos Preview model to "a limited group of critical industry partners," giving them time to prepare for a model that it said is "strikingly capable at computer security tasks." Now, the UK government's AI Security Institute (AISI) has published an initial evaluation of the model's cyberattack capabilities that adds some independent public verification to those Anthropic reports.
AISI's findings show that Mythos isn't significantly different from other recent frontier models in tests of individual cybersecurity-related tasks. But Mythos could set itself apart from previous models through its ability to effectively chain these tasks into the multistep series of attacks necessary to fully infiltrate some systems.
AISI has been putting various AI models through specially designed Capture the Flag challenges since early 2023, when GPT-3.5 Turbo struggled to complete any of the group's relatively low-level "Apprentice" tasks. Since then, the performance of subsequent models has risen steadily, to the point where Mythos Preview can complete north of 85 percent of those same Apprentice-level CTF tasks.
© Getty Images
Goldman Sachs is taking a cautious approach toward a new artificial intelligence model from Anthropic, warning that its advanced capabilities could introduce significant cybersecurity risks—even as they explore its long-term potential.
The model, known as "Mythos," has sparked concern across the financial sector due to its ability to identify and exploit software vulnerabilities at a level that could reshape both cyber defense and cybercrime.
Answering a query during a recent earnings call, Goldman Sachs CEO David Solomon said the bank is closely monitoring the risks associated with emerging AI systems including LLMs and the disruptive Mythos model from Anthropic.
“We’re hyperaware,” Solomon said, referring to the cybersecurity implications of next-generation AI tools.
He added that Goldman is actively working with Anthropic and cybersecurity partners to better understand how such models could impact financial systems and cyber defenses.
Cybersecurity has long been at the core of our business. And we have for a very, very long time, put enormous resources forward," Solomon added.
"With the help of the US government and the model publishers, we are very focused on supplementing our cyber and infrastructure resilience," he said. "And this is part of our ongoing capabilities that we have been investing in and are accelerating our investment in."
The comments reflect the current mindset of major financial institutions, which are increasingly treating advanced AI not just as a productivity tool, but as a potential security disruptor.
Unlike earlier AI systems, Mythos is designed to autonomously discover and exploit vulnerabilities in software environments. Anthropic has acknowledged that the model can “find and exploit sophisticated vulnerabilities” and, in some cases, outperform human experts.
This capability has triggered concern among cybersecurity community, who are divided and warn that such tools could lower the barrier for cyberattacks. In practical terms, even individuals without deep technical expertise could potentially use AI to identify weaknesses in operating systems, applications, or enterprise infrastructure.
Anthropic itself has taken an unusually cautious stance. The company has restricted access to Mythos and opted not to release it publicly, citing fears of misuse.
Instead, the model is being shared as a preview to 11 organizations under a controlled initiative dubbed "Project Glasswing." The organizations includes JPMorgan, Apple, Google, Microsoft, Nvidia and Goldman Sachs, among other. The initiative aims at strengthening defenses before rolling out wider deployment.
The concerns are not limited to Goldman Sachs. Discussions involving top U.S. financial leaders—including regulators and central banking officials—have reportedly taken place to assess the risks posed by such AI systems.
Banks are particularly vulnerable due to their complex mix of modern and legacy systems, which could provide fertile ground for AI-driven vulnerability discovery and exploitation.
At the same time, industry leaders see a dual-edged reality where attackers could benefit first, defenders may eventually use similar tools to identify and patch weaknesses faster.
Despite the warnings, Solomon struck a measured tone about the future of AI in business. He noted that the technology has the potential to significantly improve efficiency and transform operations across industries.
"Whenever you have acceleration of your technology, there are going to be be bumps, and there are going to be risk issues," Solomon said answering a seperate query during the call. "But the power of the technology, the ability to use it in an enterprise, to remake processes, to create efficiency, and also create more capacity to invest the growth — I can't find a CEO that's not talking about that."
This tension—between innovation and risk—sits at the center of the current debate around advanced AI systems like Mythos.
The emergence of models capable of autonomously identifying and exploiting vulnerabilities marks a potential inflection point for cybersecurity.
Experts suggest that the rapid evolution of AI could accelerate both offensive and defensive capabilities, creating a race between attackers and defenders. In the short term, however, the concern is that powerful tools may be easier to weaponize than to secure.
For financial institutions like Goldman Sachs, however, the strategy seems to be to engage early, understand the risks, and prepare defenses before such technologies become widely accessible.
