Claude Mythos found new flaws in HAWK and reduced AES, proving AI can autonomously advance cryptography research.

Anthropic published two cryptographic research results achieved by Claude Mythos Preview working mostly autonomously: an improved attack on HAWK, a post-quantum digital signature scheme currently under NIST review, and a 200 to 800 times faster attack on a reduced-round version of AES. Neither result breaks any production system today. Both results show that frontier AI can now do original cryptographic research at a level that two years of human expert review failed to achieve.

“When we launched Claude Mythos Preview, we showed it was able to autonomously find and exploit vulnerabilities in almost every piece of software we pointed it at. This included several major cryptographic libraries—shared collections of code that are used to encrypt data.” reads Anthropic’s announcement.

“The vulnerabilities that Claude found in these cryptographic libraries¹ were due to incorrect implementation of the algorithms—that is, errors in how programmers used the algorithms in their code that created opportunities for attackers to break the encryption. Now, we have found that Claude is able to find mathematical flaws in the algorithms themselves.”

The HAWK result is the more immediately significant of the two. HAWK is one of the remaining third-round candidates in NIST’s ongoing post-quantum cryptography standardization process, which has been running for nearly a decade. Mythos found a previously unexploited symmetry in the mathematical structure underlying HAWK, a nontrivial automorphism, that allows a faster enumeration attack and effectively cuts the scheme’s key strength in half. For the smallest HAWK-256 key size, the expected attack cost drops from 2^64 operations to 2^38. Doubling HAWK’s key size would restore the original security level, but that eliminates most of the practical advantages that made the scheme an attractive post-quantum candidate in the first place.

The HAWK result took 60 hours, coordinated by one Anthropic researcher who was not an expert in lattice-based cryptography.

“To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction. Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments.” continues the announcement. “After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself—and the human operator—of the attack’s correctness.”

The multi-agent workflow produced an interesting dynamic: two worker agents investigated the same idea in parallel. The first rejected it as infeasible. The second found a way to exploit it fully. They kept exchanging messages until both agreed they had found something real. Total API cost: approximately $100,000.

The AES result took longer and cost far more human time to validate than to discover. Mythos worked for three days generating several hundred million output tokens and produced what Anthropic calls a Möbius Bridge, a fingerprinting technique that eliminates one of the guesses an attacker needs to make in a meet-in-the-middle attack on 7-round AES, then compensates for the added computational cost with several optimization techniques. The attack doesn’t touch the full 10-round AES-128 used in production. The discovery was almost entirely autonomous; the researcher’s interventions amounted to three substantive prompts over three days, one of which simply said the model needed to keep searching for genuinely novel ideas rather than settling for incremental gains.

“Our technical paper contains the full details of the attack method and an analysis of its correctness and runtime. Compared to the one week that Mythos spent conceiving the idea, the vast majority of human researchers’ time was spent validating the correctness of its claims (though it is important to note the researchers are not experts in cryptography).” Anthropic states.

Two researchers spent close to a month gaining enough confidence in the result to write a paper about it.

Beyond the two main results, Mythos also developed a practical attack recovering a 13-round LEA key in under 2^30 encrypted plaintexts running in under an hour on a modern desktop, dramatically better than the prior best of 2^98 plaintext pairs and 2^86 work. Preliminary results also cover 6-round Serpent-128, with limited improvements on Salsa20, the Poseidon hash function, and SHA-1. Anthropic followed responsible disclosure throughout, sharing the HAWK finding with the scheme’s authors in June before coordinating public disclosure to the NIST mailing list alongside the paper’s release.

The broader implication is the one Anthropic states plainly: in one year, language models went from being unable to perform cryptanalysis of basic ciphers to finding flaws in designs that escaped years of expert human review. The cybersecurity community is already struggling to keep up with the volume of bugs AI can find. Anthropic predicts the same bottleneck is coming for academic cryptography research, where human researchers may increasingly find themselves spending months validating results that a model produced in days.

“Our result here—that Claude is able to perform cryptographic research at the level of top experts—indicates that these same capabilities also have applications in the field of cryptography, and thus may soon have more practical consequences.” concludes the company. “The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up. We predict that the same will soon be true in academic cryptography research. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)

CISA is using Anthropic’s Mythos AI to scan federal code for vulnerabilities, aiming to find flaws before hackers and foreign intelligence services.

Three sources familiar with the matter told Reuters that CISA, the U.S. government’s civilian cyber defense agency, is running Anthropic’s Mythos AI model against federal code repositories to find vulnerabilities before foreign intelligence services and criminal groups do.

Neither CISA nor Anthropic commented on the record. A CISA representative said last month he’d check whether there was anything to share, then stopped responding.

The operation is run by CISA’s Attack Surface Evaluation team, a unit that conducts security assessments and simulated attacks across the federal government. Two of Reuters’ sources said the audits have already turned up a large number of vulnerabilities. The exact scope, which agencies were covered, and how serious the bugs are have not been disclosed.

Mythos is Anthropic’s most capable model and it isn’t something you can access through a standard subscription. It was described, when Anthropic privately released it to select government partners, as exceptionally capable at finding and exploiting security vulnerabilities. As Reuters reported:

“The Cybersecurity and Infrastructure Security Agency is using Mythos to scan ​government code repositories for bugs that could leave the door open for foreign spies and cybercriminals, ​the sources said.” states Reuters.

The NSA has been using the same model since at least April, according to Axios, and NSA analysts testing it in classified settings came away impressed.

The company’s relationship with the U.S. government turned hostile in February when Anthropic refused to remove safeguards that prevented Mythos from being used for autonomous weapons or domestic surveillance.

The Pentagon responded by designating Anthropic as a supply-chain security risk, a label that had previously been applied only to foreign companies suspected of facilitating espionage. It was an extraordinary move against a domestic company, and it reflected how seriously the administration took Anthropic’s refusal.

A federal judge blocked the blacklisting in March. Relations began thawing after that, and the CISA deployment is a sign of how much the dynamic has shifted.

“The ​extraordinary blacklisting was blocked by ​a judge in March, and the ⁠conflict has eased following the private release of Anthropic’s Mythos, an AI model described as extremely capable at finding and exploiting cybersecurity vulnerabilities.” continues Reuters.

Giving the government access to the most capable version of the tool appears to have done more to repair the relationship than any amount of negotiation.

When Anthropic launched Fable in early June, described as a public version of Mythos with cybersecurity safeguards added, the White House responded by demanding that the company ban foreign nationals from running it. That demand led to a temporary global shutdown of the model. It was lifted only last week, after what Reuters described as a standoff that illustrated how differently the administration treats the private and public deployments of the same underlying technology.

The pattern is now clear: Mythos in government hands, scanning classified systems and federal code, gets quiet approval and active deployment. Mythos in public hands, accessible to anyone including foreign users, immediately triggers national security concerns and regulatory pressure. As Reuters noted on the timeline of events:

“when Anthropic rolled out a public version of Mythos called Fable, ⁠which included ​what it described as cybersecurity safeguards, the White House suddenly demanded ​that it ban foreigners from running it. This triggered a global shutdown of the model that was lifted only last week.” continues the agency.

Anthropic has confidentially filed for a U.S. IPO. Having CISA, the NSA, and potentially other agencies actively deploying your most capable model is a materially different position than being on a Pentagon blacklist, and the company got from one to the other in under five months.

A late-June AP report added another data point: a U.S. official said Mythos had identified vulnerabilities in highly sensitive government systems during a testing exercise, which is exactly the kind of result that makes agencies want to expand the program rather than wind it down.

Senate testimony claimed Anthropic’s Mythos AI breached NSA and Cyber Command systems in hours, prompting a U.S.-ordered shutdown.

According to a report by The Economist citing a Senate Intelligence Committee hearing, Anthropic’s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.

“Encryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”.”reported The Economist.

The number of vulnerabilities found so far hasn’t been disclosed, but two sources described it as large.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Mythos)

Squidbleed is a 29-year-old Squid Proxy flaw that can leak credentials, tokens, and other users’ HTTP data through a memory overread.

Researchers at Calif.io have disclosed CVE-2026-47729, a memory leak vulnerability in Squid Proxy that was introduced in 1997 and has remained undetected through nearly three decades of releases, audits, and rewrites. They named it Squidbleed because it works like Heartbleed: it causes the proxy to read past the end of a memory buffer and hand the contents to whoever asked.

“The bug occurs when no filename is provided after the modification timestamp.” reads the report published by the researchers. “Here’s such an example:

d [R----F--] supervisor            512       Jan 16 18:53

In that case, *copyFrom is the null terminator at the end of the string.

However, instead of returning NULL and breaking out of the loop, strchr returns a pointer to the null terminator, as it is considered part of the string. This causes ++copyFrom to be executed and the cycle repeats until a non-null, non-whitespace byte is reached.“

The pointer then walks forward past the buffer boundary until it hits a non-null, non-whitespace byte, and whatever it finds there gets sent back to the attacker as a filename. The fix is two characters: check that *copyFrom isn’t null before calling the function strchr. One line of C, twenty-nine years of exposure.

The bug resides in Squid’s FTP directory listing parser, specifically in code written to handle NetWare FTP servers, which used four spaces between the timestamp and filename instead of one.

“The data starting from that byte, possibly belonging to another Squid Proxy user, is then returned to the attacker as the name of a file in the directory listing.” continues the report. “Since FTP support is enabled out of the box, and port 21 is included in the default Safe_ports ACL, no special flags or non-default settings are needed. The attacker only needs to control an FTP server reachable from the proxy.”

Squid is common in multi-user environments, corporate networks, schools, public Wi-Fi, and the researchers even spotted it running on an in-flight Wi-Fi system, on a version released nearly a decade ago.

What actually leaks is the contents of other users’ HTTP requests. Squid manages memory through per-size recycled buffer pools and doesn’t zero them when they’re freed.

“The line buffer used to parse FTP listings is allocated from MEM_4K_BUF. If that buffer previously held a victim’s HTTP request, only the first few dozen bytes are overwritten by the short FTP line — the rest of the 4KB buffer still contains the victim’s stale data.” states the report. “The strchr overread walks right past the null terminator and sends it all to the attacker.”

The researchers demonstrated it by leaking an Authorization header from a login page. Credentials, session tokens, API keys — anything that travels in a cleartext HTTP request through the shared proxy is in scope.

The exposure is limited. The researchers pointed out that standard HTTPS connections routed as opaque CONNECT tunnels aren’t affected, and the attacker needs to reach an FTP server from the proxy. But in corporate and legacy environments, sensitive data in cleartext HTTP isn’t unusual.

The researchers confirmed that they used Claude Mythos Preview to find the bug. When pointed at Squid’s FTP state machine, it identified the strchr null terminator behavior almost immediately, citing the exact C11 standard clause that makes strchr(w_space, '\0') return non-null. Few human reviewers would catch that. It also recently found a high-severity OpenSSL vulnerability and the HTTP/2 Bomb denial-of-service technique, both through the same AI-assisted approach.

A patch was merged into Squid version 8 in April 2026 and shipped in version 7.6 in June 2026. If you can’t patch immediately, disabling FTP support removes the attack surface entirely. Chrome dropped FTP years ago, and most organizations running Squid are getting close to zero legitimate FTP traffic, turning it off costs nothing. FTP parsing might not be the only place where Squid forgot to stop reading.

“The dangers of raw memory access in C are well understood, but the subtleties of standard library functions like strchr are easier to overlook. Few developers would guess that searching for '\0' succeeds, which may explain how a one-line bug survived close to 30 years of code review.” concludes the report. “Claude Mythos Preview, having trained on the entire C standard reference, treats this quirk as just another fact. When pointed at the right code, it spotted the bug almost immediately.”

Below is a video PoC of the attack along with PoCs.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, TPWD)

Senate testimony claims Anthropic’s Mythos AI breached NSA and Cyber Command systems in hours, prompting a U.S.-ordered shutdown.

On June 12, the Trump administration directed Anthropic to restrict access to Fable 5 and Mythos 5, its two most capable models, exclusively to US citizens. Because verifying every user’s nationality in real time isn’t practically possible, Anthropic’s only option was to shut both models down for everyone. Allies included. No warning.

The U.S. government ordered Anthropic to limit access to its Fable 5 and Mythos 5 AI models to U.S. citizens after a jailbreak was discovered.

That includes Five Eyes partners, Australia, the UK, Canada, and New Zealand, and it blocked the UK AI Security Institute, the main international body for testing frontier AI models, from accessing systems it was actively evaluating.

Then came the Senate testimony. According to a report by The Economist citing a Senate Intelligence Committee hearing, Anthropic’s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.

“Encryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”.”reported The Economist.

“Advanced AI differs from encryption in another respect, too. Whereas cryptography eventually became widely available abroad, America today enjoys a clear lead in AI. China, hobbled by American chip controls, is probably about a year behind. That advantage could become unassailable if Anthropic or other American labs crack recursive self-improvement (RSI), whereby models write better versions of themselves and thereby accelerate progress. Many insiders think that is entirely possible.”

These are unverified claims reported through Senate testimony, not independently confirmed facts, and the story is still developing.

Whether or not the NSA account holds up, Mythos is real and its capabilities aren’t in dispute. Anthropic refused to release it publicly, instead giving access to roughly 200 selected partners under an initiative called Project Glasswing. Amazon, Apple, Google, Microsoft, Nvidia, JPMorgan, and the Linux Foundation are among the participants.

Anthropic says Mythos Preview has already uncovered thousands of vulnerabilities, including a 27-year-old flaw in OpenBSD, one of the most security-hardened operating systems ever developed. That’s more than a marketing claim—it is a strong indication of the model’s real-world capability to identify complex and previously undiscovered security weaknesses.”

For people who’d been using Fable 5 before the ban, the loss was tangible. Unlike previous models that required constant hand-holding, Fable 5 ran complex coding tasks for up to 20 minutes autonomously, caught its own logic errors, wrote its own tests, and delivered working software on the first run. It sat above the Opus line in Anthropic’s lineup and used the same underlying architecture as Mythos, with additional safeguards added for general use. It came with a mandatory 30-day data retention policy and premium pricing, and there was a planned shift to usage-based credits set for June 23. Fable didn’t survive long enough to see it.

The broader context makes the shutdown harder to read as a clean security decision. For months, the Trump administration had been dismantling AI regulations from the previous administration, approved advanced chip sales to China, and on June 2 issued an executive order asking AI labs to voluntarily share new models with the government before public release.

Then, ten days later, access was cut without notice, and the government body responsible for evaluating dangerous AI capabilities was ordered to stop publishing its reports. That’s a sharp reversal in a very short window. Europe is already paying attention, with concern growing that the same scenario could play out with Azure, AWS, Google, and every other US-based cloud provider.

The debate sparked by this decision has divided the cybersecurity community. On one hand, restricting access to offensive AI capabilities reduces the risk that cybercriminals, ransomware groups, or state actors could automate highly dangerous activities. On the other hand, the same constraints can hinder defenders, red teams, and security researchers who rely on such tools for testing and analysis.

Advanced AI models and geopolitics add another layer of complexity. Safety guardrails are not perfect: researchers have repeatedly shown that even robust systems can be bypassed through advanced prompt engineering. Security is therefore not static but an ongoing cycle between control mechanisms and attempts to circumvent them.

Beyond the technical dimension, the geopolitical aspect is even more significant. Project Glasswing illustrates how access to advanced AI-driven cybersecurity capabilities is becoming a strategic asset. Early participants were mainly US-based companies such as Microsoft, Google, Apple, Cisco, CrowdStrike, and NVIDIA, with European and other international actors included only later.

For Europe, this raises a critical issue. While it has developed strong regulatory frameworks through the AI Act, NIS2, and the Cyber Resilience Act, the most advanced AI systems are still built elsewhere. The continent regulates AI but does not yet control comparable frontier models within its own ecosystem.

Even participation by ENISA and other European bodies does not fully resolve dependency on external providers. The concern is no longer only data sovereignty, but also analytical sovereignty: advanced AI systems generate highly sensitive intelligence about critical infrastructure vulnerabilities.

For countries like Italy, this creates practical questions about where such data is stored, who can access it, and how it might be used. Since providers like Anthropic also collaborate with US government entities on national security issues, governance of this information becomes even more sensitive.

Ultimately, AI is reshaping cybersecurity from a human-driven discipline into a model-driven one. Competitive advantage will depend less on discovering vulnerabilities and more on managing them at scale. Those who master these systems early will gain a lasting strategic edge, while others risk increasing dependency on external technologies that are rapidly becoming central to global digital security.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NSA)

OpenAI has officially entered the AI cybersecurity race with the launch of OpenAI Daybreak, a new initiative focused on helping security teams identify, validate, and fix software vulnerabilities faster using artificial intelligence. Announced through the company’s LinkedIn post, OpenAI described Daybreak as its vision for “a new era of cyber defense,” where AI systems can assist defenders across secure code reviews, vulnerability analysis, remediation, and threat investigation workflows. The launch reflects a growing industry trend in which AI companies are positioning advanced language models as cybersecurity tools capable of reducing the time between vulnerability discovery and remediation. While AI-generated coding tools have often raised concerns around insecure code generation, companies are now increasingly focusing on using AI defensively to strengthen software security practices. According to OpenAI, AI models are already changing how security teams operate by enabling them to reason across large codebases, identify subtle vulnerabilities, validate fixes, and analyze unfamiliar systems more efficiently. However, the company also acknowledged that advanced AI cybersecurity capabilities require “trust, verification, safeguards, and accountability,” particularly as AI systems become more capable of handling sensitive defensive workflows.

What Is OpenAI Daybreak?

At the center of the announcement is OpenAI Daybreak, a cybersecurity-focused platform powered by GPT-5.5 and Codex, OpenAI’s coding-focused agentic system. OpenAI said the platform is designed to help organizations move from vulnerability discovery to remediation faster while improving visibility into the entire security workflow. The system combines AI reasoning with coding automation to support several defensive security functions, including:

• Secure code reviews
• Threat modeling
• Patch validation
• Malware analysis
• Dependency risk analysis
• Remediation guidance
• Vulnerability triage
• Detection engineering

One of the more notable capabilities highlighted by OpenAI is the platform’s ability to generate and test patches directly within repositories. According to the company, these workflows operate under monitored and controlled access models while also producing audit-ready reports that help security teams verify remediation activity. The emphasis on auditability suggests OpenAI is attempting to address one of the biggest concerns surrounding AI in cybersecurity: the need for accountability and human oversight in automated decision-making.

OpenAI Introduces Tiered Cybersecurity Access

OpenAI is rolling out Daybreak through three different access levels depending on the sensitivity and complexity of cybersecurity operations. The first layer uses GPT-5.5 for broader security assistance and general workflows. The second tier, GPT-5.5 with Trusted Access for Cyber, is aimed at defensive cybersecurity tasks such as secure code review, malware analysis, vulnerability triage, detection engineering, and patch validation. The highest tier is powered by GPT-5.5-Cyber, which OpenAI says is intended for specialised and authorised workflows including penetration testing, red teaming, and controlled validation exercises. The structured access model indicates OpenAI is taking a cautious approach toward releasing advanced cyber capabilities, especially as concerns grow around dual-use AI systems that can potentially be misused by threat actors.

AI Cybersecurity Competition Continues to Grow

The launch of OpenAI Daybreak also comes at a time when AI companies are increasingly competing to establish themselves in cybersecurity operations. Recently, Anthropic introduced Claude Mythos, a cybersecurity-focused AI system that the company claimed could identify software vulnerabilities at a scale beyond what human experts can typically achieve. However, Anthropic stated that Claude Mythos would not be released publicly due to risks associated with its advanced cyber capabilities. That contrast highlights a broader debate currently shaping the AI cybersecurity sector. While companies see AI as a major force multiplier for defenders, there are ongoing concerns about how powerful cyber-focused AI models should be deployed, monitored, and restricted. For OpenAI, Daybreak appears to position the company toward enterprise-controlled and monitored security environments rather than open public access.

AI’s Role in Cyber Defense Is Expanding

The launch of OpenAI Daybreak reflects how rapidly AI is becoming embedded into cybersecurity workflows. Security teams are increasingly under pressure to manage growing attack surfaces, software complexity, and faster-moving threats, making automation and AI-assisted analysis more attractive. At the same time, the rollout of advanced cyber-focused AI systems is likely to intensify discussions around governance, oversight, and responsible deployment. With companies like OpenAI and Anthropic now building specialised cybersecurity AI platforms, the next phase of cyber defense may increasingly depend on how effectively organizations balance AI-driven speed with security safeguards and human verification.