On July 28th Anthropic announced new cryptanalytic attacks discovered using their LLM Claude Mythos:

• A key-recovery attack on HAWK, a post-quantum signature scheme candidate in NIST’s “Additional Digital Signatures” standardization project. Except for the toy version HAWK-256 whose 64-bit security is practically breakable, the new attack is not practical. But it's a meaningful break of HAWK’s security, as it reduces the estimated security level of HAWK-512 from its 128-bit target to at most 108 bits and, speculatively, as little as 81 (see Appendix C of the paper.)

• An improved key-recovery attack on 7-round AES-128, while the full version does 10 rounds. The attack is , and totally not a surprise, posing no threat to AES. But since new cryptanalytic results for AES are rare, this result is noteworthy regardless of the way it was found. The negative result is, perhaps, more significant: Mythos found no stronger attack, let alone against full-round AES.

In the AES attack paper, Anthropic writes “We believe that further exploring the direction of LLM-assisted cryptography research is interesting—particularly in cases where the attacks developed are computationally intractable to implement and require that the language model demonstrate its correctness through a combination of approaches. One direction we believe to be particularly important is to formalize the attack techniques used in the cryptographic community.”

I agree with that, notably the last statement: symmetric cryptanalysis needs more unified descriptive frameworks and abstraction; too many papers use ad hoc formalism and custom notations and terminology when they’re fundamentally doing the same thing as others.

I also expect LLMs to find errors in cryptanalytic attacks’ complexity estimates and in security proofs. Earlier this year I asked LLMs to find bugs in security proofs of EUROCRYPT 2026 papers and they found issues in most of the proofs (showing that the proof, though not necessarily the result, was incorrect.)

Anthropic also helped create CryptanalysisBench, an LLM benchmark comprising cryptanalysis tasks on full- and reduced-round versions of AES, ChaCha, and on algorithms submitted to NIST’s competitions—like BLAKE—including post-quantum schemes.

If you’re unfamiliar with cryptanalysis, it’s not unreasonable to wonder whether LLMs could break AES, ChaCha, SHA-3, and other symmetric algorithms in use today—as a friend asked me, “aren’t you worried that Mythos could break BLAKE3?”. I’m not.

More broadly, I’m confident that LLMs won’t break any of the established cryptographic schemes, and won’t disprove Too Much Crypto’s conjectures.

In an excellent post, Matthew Green writes [with my notes] that “our symmetric ciphers [block/stream ciphers but also hash functions and MACs] are very messy [again, no “unified theory”] and robust [empirically so; more on this later]. Imagine a farmer who drags a tractor out into a patch of quicksand, and then buries it under cement. That’s what symmetric cipher design is like; it’s deliberately designed to come up with structures that are quick and easy to apply [typically, a round’s operations], but very messy and hard to untangle [as you iterate rounds]. The addition of many new raw intelligence-hours probably aren’t going to magically improve this.”

I'd like to elaborate on what Matt calls messiness and structure, and why these are key reasons why LLMs won’t find a practical collision attack on SHA-3 or BLAKE3.

So, why LLMs won’t break symmetric crypto? In largely-but-not-totally-arbitrary order:

1. Their high-level structure is secure: Here I mean constructions such as the GCM and CTR modes of operation for block ciphers and hash-function modes such as the sponge construction. I also include the round-based construction of the keyed or unkeyed permutations at the core of most symmetric schemes—though not all of them; Poly1305, for example, isn’t round-based.

2. They have no mathematical structure. Unlike actual math problems and unlike most public-key schemes, symmetric ciphers can’t generally be described as clean transforms within a mathematical structure—structure that allows reduction-based security proofs, but also what may be exploited for cryptanalysis (an exception is arithmetization-oriented primitives and in particular so-called algebraic hash functions, such as Poseidon, as used in ZK proof systems and FHE; another exception is VSH, a hash function based on RSA-like operations, which was proved collision-resistant but turned out not to be preimage resistant, showing structure’s double edge.) When designing a hash function or block cipher, your goal is to eliminate any structure, symmetry, or pattern that would let an attacker describe the computation as something simpler than the apparently senseless sequence of elementary operations it performs. BLAKE3, for example, is essentially a long sequence of XORs, modular additions, and bit rotations. There’s no other way to describe it. There’s no obvious space to navigate or high-level structure to reason about: XOR destroys linearity with respect to modular addition, while modular addition destroys linearity with respect to XOR. Consider the n-bit permutation of a sponge construction as a bijection over GF(2)ⁿ: its representation as a system of multivariate equations over GF(2) is expected to have no remarkable structure: maximal degree, a high density of monomials, and so on. The same should hold for representations over other fields. That’s Matt’s idea of messiness.

3. It’s mostly differential cryptanalysis. Whether it’s linear cryptanalysis, rectangle attacks, boomerang attacks, integrate attacks, cube attacks, as well as slide attacks and most cryptanalysis tricks, all are forms of differential cryptanalysis: they exploit input–output patterns of the form “if we apply this difference in the input [wrt some operator, typically XOR], then the output [of some component of the cipher] statistically deviates from the ideal/expected case.” For example, collision attacks on SHA-1 exploited that some differentials has exceptionally high probability, while impossible differential techniques exploit probability-zero differentials. If a symmetric primitive's mode is (proved) secure, then very little else to do than differential cryptanalysis. This territory has already been explored extensively; LLMs are therefore unlikely to discover entirely new classes of attack.

4. Differential cryptanalysis is empirical, at least partially. In many cases cryptanalysts find statistical biases by running experiments without understanding exactly why those biases exist. After observing comparatively large biases, like 2^-10, they may infer the existence of smaller biases that would require too many samples to measure reliably but could nevertheless be exploited in an attack. I’m not claiming that an LLM cannot run such experiments, but the need to design, execute, and interpret them makes its task more difficult.

5. They’re time- and battle-tested: These designs have received thousands of hours of cryptanalytic scrutiny, most of it unsuccessful and therefore unpublished. Researchers have applied human ingenuity, creativity, and vast amounts of computation to search for biased statistics and to perform automated analysis and sometimes formal verification. And what have they found? Mostly the predictable result that reduced-round variants are easier to break, while the strength of the algorithms increases dramatically as rounds are added.

As a friend commented, "it's kind of a historical quirk that we had unsafe symmetric crypto." Symmetry cryptography is the strongest part of our security systems, thus LLM tokens are much better spent finding bugs elsewhere, including in underanalyzed post-quantum standardization candidates.

Featured image: Peter Bruebel, The Fall of the Rebel Angels (detail)