Anthropic's LLM, Claude Mythos, recently discovered cryptanalytic attacks on two targets: a key-recovery attack on HAWK-512, a post-quantum signature candidate, and an improved attack on 7-round AES-128. The HAWK attack reduces its security from 128-bit to at most 108 bits (speculatively as low as 81). The AES attack is not a practical threat—full AES-128 uses 10 rounds. Neither attack breaks any production cryptographic scheme.

These results, detailed in Anthropic's papers, are noteworthy because new cryptanalytic results for AES are rare. But the negative result is more significant: Mythos found no stronger attack, let alone one against full-round AES. In the AES paper, Anthropic writes: "We believe that further exploring the direction of LLM-assisted cryptography research is interesting—particularly in cases where the attacks developed are computationally intractable to implement and require that the language model demonstrate its correctness through a combination of approaches."

As a cryptographer, I agree, especially with the call to formalize attack techniques. Symmetric cryptanalysis suffers from ad hoc formalism and inconsistent notation. LLMs could help unify these descriptions and find errors in security proofs. Earlier this year, I asked LLMs to review EUROCRYPT 2026 papers and they found issues in most proofs—though not necessarily in the results themselves.

Why LLMs Won't Break Real Symmetric Crypto

1. High-Level Structure Is Secure

Symmetric schemes like AES, ChaCha, and SHA-3 are built on constructions (e.g., sponge, Merkle-Damgård) with proven security when the underlying primitive is ideal. The round-based permutations are designed to be messy—a long sequence of XORs, modular additions, and rotations. Unlike public-key crypto, there's no clean mathematical structure to exploit. For example, BLAKE3 is essentially XORs and additions; no other description exists.

2. No Mathematical Structure to Reason About

Public-key schemes rely on number theory, but symmetric primitives are deliberately unstructured. The n-bit permutation of a sponge is a bijection over GF(2)^n with no expected algebraic simplifications. This messiness is a feature, not a bug.

3. Differential Cryptanalysis Is the Only Game

Most attacks—linear, boomerang, integral, cube—are variations of differential cryptanalysis. They exploit statistical biases in input-output patterns. This territory is heavily explored; LLMs are unlikely to find entirely new attack classes. Differential attacks are empirical: cryptanalysts run experiments, observe biases, and infer smaller ones. LLMs can't easily design and interpret such experiments without human guidance.

4. Time-Tested Designs

AES, SHA-3, and BLAKE3 have survived decades of scrutiny. Thousands of hours of human analysis have failed to break them. Adding more "intelligence hours" via LLMs won't magically change that. As a friend noted, "it's kind of a historical quirk that we had unsafe symmetric crypto." Symmetric crypto is the strongest part of our security stack.

What This Means for Developers

Don't worry about LLMs breaking AES-256 or BLAKE3. Your data is safe. Instead, focus on the real risks: bugs in implementations, insecure protocols, and underanalyzed post-quantum candidates. LLM-assisted cryptanalysis might help find flaws in new schemes, but it won't undermine established ones.

If you're curious, Anthropic also released CryptanalysisBench, a benchmark for LLM cryptanalysis tasks. It includes reduced-round AES, ChaCha, and NIST submissions. But don't expect it to produce practical attacks on full versions.

Next Steps

  • Keep using AES-256, ChaCha20, and SHA-3 without worry.
  • Watch for formalization efforts in symmetric cryptanalysis—they could improve the field.
  • If you're working with post-quantum signatures, stay updated on HAWK's revised security estimates.