Loading story…
Researchers reported that HAWK, a lattice-based digital signature candidate in NIST's additional post-quantum signature process, can be weakened when an attacker knows a nontrivial automorphism of the underlying integer lattice. In the paper "HAWK: Having Automorphisms Weakens Key", the authors show that for cyclotomic rings whose degree is a power of two, the search rank-2 module Lattice Isomorphism Problem used by HAWK can be reduced to an instance with at most half the rank, accelerating key-recovery attacks by at least a quadratic factor and effectively cutting the scheme's security margin by roughly half in bits.
The work does not claim a full practical break of HAWK, but it identifies a new attack avenue tied to the automorphism group of the lattice structure. The paper also links its findings to earlier ASIACRYPT 2024 research by Luo et al., which identified a symplectic automorphism that broke HAWK's original omSVP assumption; the HAWK team subsequently revised that definition in its second-round NIST additional-signatures submission. HAWK remains listed among NIST's additional digital signature candidates, making the result relevant to organizations tracking the resilience of post-quantum signature schemes under evaluation.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The paper "HAWK: Having Automorphisms Weakens Key" reports that knowing a nontrivial automorphism can reduce certain HAWK lattice isomorphism instances to at most half the rank, speeding key-recovery attacks by at least a quadratic factor and effectively halving security bits. The authors state this does not currently break HAWK but reveals a new theoretical attack avenue.
A public HAWK project website is available, providing a reference point for the scheme and its materials.
NIST's project page for additional post-quantum digital signature schemes lists the Round 3 candidates, including HAWK, as part of its standardization process for additional signatures.
A new paper presents a deterministic polynomial-time reduction from HAWK key recovery to polynomially many exact SVP oracle calls in dimension n/2 + 1, improving prior attack costs. The authors estimate reduced gate counts for HAWK-512 and HAWK-1024 and report recovering HAWK-256 secret keys end-to-end in a few hours on a single server.
According to the ePrint paper, the HAWK team revised the omSVP definition in its second-round NIST additional signatures submission to account for a symplectic automorphism identified by prior work from Luo et al. at ASIACRYPT 2024.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
eprint.iacr.org
Open sourcehawk-sign.info
Open sourcecsrc.nist.gov
Open sourceanthropic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic disclosed that its **Claude Mythos Preview** model helped uncover two new cryptanalytic results: an end-to-end key-recovery attack against the post-quantum signature target **HAWK-256** and a substantially faster attack on **7-round AES-128**. In the HAWK work, researchers said the model identified a previously unused symmetry in the scheme’s lattice structure, cutting the estimated cost of breaking HAWK-256 from about `2^64` to `2^38` operations and making recovery practical for that challenge parameter, while **HAWK-512** and **HAWK-1024** remain impractical to attack. Anthropic said the AES result improved an existing meet-in-the-middle attack by removing a `256`-way guessing step through a new fingerprinting technique described as a **Möbius Bridge**, yielding a roughly **200- to 800-fold** speedup against reduced-round AES-128. The company emphasized that **full 10-round AES-128 remains secure** and that neither finding requires changes to production systems, but said the results show frontier AI can materially accelerate cryptanalysis; Anthropic coordinated disclosure of the HAWK finding with the scheme’s authors and **NIST**, and released technical papers, code, reproducibility artifacts, and a new **CryptanalysisBench** benchmark.
Aug 7, 2026
Anthropic said its `Mythos` AI security model found a weakness in the post-quantum digital signature candidate **HAWK**, prompting the algorithm’s withdrawal from NIST consideration after the system reportedly identified a new way to locate automorphisms that cut HAWK’s effective security roughly in half. The same research also improved a meet-in-the-middle attack on a deliberately weakened seven-round AES challenge, reducing the known-plaintext requirement from about `2^105` to `2^89`, although both results were described as impractical against widely deployed production cryptography and focused on challenge systems or immature candidates rather than live enterprise deployments. The developments come amid broader concern that AI is changing how cryptanalytic claims are validated, because multiple researchers may rely on the same models and inherit common failure modes while appearing independent. Recent examples cited in the debate include near-simultaneous July papers on unclonable encryption that both credited OpenAI’s `GPT-5.6 Sol Ultra` with core ideas, and AI-assisted reviews of a claimed polynomial-time algorithm for the Dihedral Coset Problem that disclosed model involvement unevenly; researchers are calling for clearer provenance, explicit verification-status reporting, and continued emphasis on **crypto-agility** rather than abrupt changes to post-quantum deployment plans based on early AI-assisted findings.
Aug 15, 2026
wolfSSL fixed two flaws in its hand-optimized ML-KEM-1024 SIMD decapsulation code that can permit near-complete private-key recovery when static ML-KEM keys are reused and an attacker can access a plaintext-checking or decapsulation oracle. **CVE-2026-10097** affects AVX2 builds by omitting comparison of the final 32 bytes of a 1,568-byte ciphertext, while **CVE-2026-6330** affects ARM64 NEON builds by leaving approximately half the ciphertext unchecked. Researchers reported recovery of 98.0% of secret coefficients with 400 chosen ciphertexts on AVX2 and 98.5% with 600 on NEON; wolfSSL addressed both issues in version 5.9.2. The defects are implementation failures in wolfSSL’s independently written SIMD Fujisaki–Okamoto ciphertext validation, not a break of ML-KEM or FIPS 203. They add to prior evidence that post-quantum cryptographic deployments remain exposed to implementation-level side channels: the KyberSlash research found secret-dependent timing behavior in several Kyber/ML-KEM implementations, including reference code, that enabled practical secret-key recovery on Raspberry Pi 2 and Arm Cortex-M4 systems. Organizations using wolfSSL should upgrade to 5.9.2 or later, identify long-lived static ML-KEM keys on affected AVX2 or NEON systems, and prioritize rotation of potentially exposed keys; TLS 1.3 deployments using freshly generated ephemeral hybrid ML-KEM keys are not susceptible to this key-recovery attack.
Sep 13, 2026