Anthropic's cryptanalysis results: verification is now the job

The Anthropic cryptanalysis results published in late July 2026 got read two ways online, and both readings were wrong. One camp saw "AI breaks AES" and panicked. The other saw a marginal paper improvement and shrugged.

Matthew Green's post at Cryptography Engineering is the calibrated middle, and buried in it is the line that actually matters for anyone building software with these tools: verification, not generation, is now the bottleneck.

---

🔍 The two results are not the same result

Green pulls the two apart hard, and the gap between them is the whole story. Both came out of Claude Mythos, Anthropic's still-unreleased advanced model.

	HAWK	Reduced-round AES
What it is	Key recovery against a proposed post-quantum signature scheme	Improved attack on a 7-round variant of AES
Deployed anywhere?	No — proposed, not standardised	Full AES runs 10/12/14 rounds; 7-round is a lab target
Cost of the attack	Runs in a few hours of wall-clock time against a weakened challenge instance	2⁸⁹ cipher operations and 2¹⁰⁵ chosen plaintexts
Novelty	Halves the security bits; still exponential time	Constant-factor improvement over prior work from 2013
Practical impact	Real — the scheme's efficiency case largely collapses	None

Green on the AES side: it is "a small increment in our knowledge, not a practical new attack."

The HAWK result is the meaningful one, and Green flags why it should make the field uncomfortable: the attack invents no new mathematics. It extends tools that were already lying around and applies them more thoroughly than anyone had bothered to. Anthropic's team, by his reading, did not tune the model with deep domain expertise — they pointed it at the problem and kept it grinding.

---

✅ The verification asymmetry is the transferable lesson

Here is the part I keep coming back to. The two results are equally "AI-generated," but they are wildly unequal in how expensive they are to trust.

• HAWK shipped running code. You send it over, someone runs it, it recovers keys or it doesn't. Verification is close to free.
• The AES result is a paper claim. Nobody can run 2⁸⁹ operations. It is an on-paper analysis that may or may not survive contact with a full implementation. Verification needs expert human attention, or formal proofs whose theorem statements themselves need expert human attention.

Green's warning generalises well past cryptography:

Key takeaway: Models are good at producing real results, and even better at producing results that look real but are misleading. The output that carries its own proof is worth many times the output that doesn't.

That is a design instruction for how you use AI in your own work, not just a caution. If you are a solo developer or a three-person shop, the practical version is: push your AI-assisted work into forms that check themselves.

1. Prefer code with tests over code with a confident explanation.
2. Prefer a script that produces a number over a chat answer containing a number.
3. Prefer a migration you can run against a copy of the database over a plan you can only read.
4. When the output genuinely can't self-verify — architecture calls, security assumptions, tax or legal logic — budget real human review time and don't pretend otherwise.

This is why the calculators on this site keep their maths in a plain, testable module with the official source cited in the file header. Not because it's tidy. Because that's the shape of work you can actually check.

---

💰 The $20 perception gap

Green makes an aside that lands harder in Sri Lanka than in Baltimore:

"The people who think models are dumb are mostly using Google's free AI search results, and not interacting with the high-end stuff (which only costs $20, so it's not out of reach.)"

He also notes he doesn't have Mythos or $100k to spend on it, and still cites measurable, impressive progress over the past five months on specific problems he's been feeding these models.

For a local engineer that gap is real in both directions:

Tier	What you're actually judging
Free AI summaries in search results	The cheapest, most compressed output a vendor ships
Free chat tiers	Older or smaller models, tight limits
Paid frontier tier (~$20/mo)	What researchers like Green are describing
Unreleased research models	Not available to you at any price

If you've formed your opinion of AI capability from the first row, your opinion is about the first row. That's a genuinely expensive mistake to make about your own field. Twenty dollars is not nothing on a Sri Lankan salary — check what it is in rupees this week with our LKR exchange rate tool — but it is cheap relative to being wrong about where your profession is going. If you're deciding which one to pay for, our AI model comparison lays the options side by side.

---

🏊 The pond has an edge, and it's moving

Green's analogy for working with these models is the best one I've read. You're swimming in a pond where the ground drops off sharply. One minute you're wading with support underfoot. Then you cross a line and you're swimming on your own.

Two practical consequences:

• The line is findable. If you're doing advanced work, you can locate the drop-off yourself, usually fast. That's a skill worth building deliberately: probe for the edge on every new class of task before you trust output at volume.
• The line is drifting outwards. Green says he can measure it over five months. A capability boundary you mapped in January is not the boundary you're standing on now.

The failure mode isn't using AI or refusing to. It's mapping the edge once and then trusting a stale map — in either direction. People who wrote these tools off in 2024 and never re-tested are as badly calibrated as people who assume the model can do anything.

---

💡 What this means for you

Nothing here is a reason to change your TLS config. Symmetric ciphers, as Green describes them, are deliberately messy and hard to untangle. Public-key cryptography has more surface area, and we're mid-transition to post-quantum schemes, which is arguably the best possible timing for a new source of cryptanalytic effort to arrive.

What changes is closer to home:

• Stop judging model capability from free search summaries. Test the paid tier on a problem you personally know the answer to.
• Re-test quarterly. The boundary moved measurably in five months for a working cryptographer. Your assumptions have a shelf life.
• Build for verifiability. Structure AI-assisted work so a machine can check it. Running code, passing tests, reproducible outputs. Where that's impossible, staff the review.
• Value the checking skill. If generation is getting cheap and verification isn't, the person who can rigorously check a result is the one holding the scarce thing. That's a career position available from anywhere, including here, with no capital required.

The pleasant surprise in Green's post is how ordinary the winning method was: no expert prompt engineering, just persistence against a problem plus a way to tell whether the answer was real. That's available to a student in Kandy with a laptop and a paid subscription. The hard part was never the prompt.