Mythos quantum: what Claude Mythos actually broke, and why KXCO is untouched

01What Claude Mythos actually found

Mythos produced two results, and the headline that fused them into one is where most of the confusion came from. They are separate findings with very different weight, so take them one at a time.

The HAWK result

The first result, and the one that generated the post-quantum headlines, concerns a scheme called HAWK. HAWK is a digital signature algorithm: the kind of mathematics that proves a message or a document genuinely came from whoever claims to have sent it. Working with the model, Anthropic's researchers identified a previously unexploited mathematical symmetry buried in HAWK's lattice structure, and used it to improve the best-known key-recovery attack against the scheme. For the smallest parameter set, HAWK-256, the estimated cost of a full key recovery fell from roughly 2⁶⁴ operations to about 2³⁸. On a 96-core server, the code Anthropic released recovered the HAWK-256 signing material in a little under four hours end to end. The model developed the attack in about 60 hours, and Anthropic estimated each breakthrough cost on the order of 100,000 US dollars in compute.

That is a genuine, serious piece of cryptanalysis, and it is the part worth respecting. It is also the part the headlines stripped of its single most important qualifier: HAWK is not a standard. It is a candidate. It was submitted to a NIST competition, the additional-signatures on-ramp, where new schemes are deliberately stress-tested so that flaws surface before anyone builds on them. HAWK was never selected, and after this it almost certainly never will be. The process did exactly what it exists to do. A weakness got found during testing rather than in production, which is the entire point of running the competition.

A candidate breaking during the competition is not the system failing. It is the system working, in public, before anyone had built on the thing that broke.

The AES result

The second result concerns AES, the workhorse cipher that protects most of the encrypted traffic on the internet. Mythos invented a technique the researchers named the Möbius Bridge and used it to speed up an existing attack by between 200 and 800 times. That number sounds alarming in isolation, so here is the qualifier that the number is meaningless without: the attack works only against a deliberately weakened version of AES-128 that uses seven of its ten rounds, and even then it requires an impractical volume of chosen plaintext. Full AES is not affected. Anthropic said so directly, and stated that no production software needs to change as a result.

Anthropic also handled disclosure the way responsible cryptanalysis is supposed to be handled. It reported both findings to the algorithms' authors and to government and industry partners, and coordinated the HAWK result with NIST, before publishing. This was not an attack loosed into the wild. It was research, disclosed properly, on schemes that were being tested precisely so that this could happen.

02What HAWK is, and why it broke

To see why the HAWK result does not generalise to the schemes that matter, you have to understand what made HAWK different in the first place. All of the leading post-quantum signature schemes are built on lattices, a branch of mathematics whose hard problems are believed to resist both classical and quantum attack. But lattice is a family, not a single design, and within it the schemes make very different trade-offs.

HAWK was one of the more ambitious designs. It used a particular hidden structure, based on a problem known as the lattice isomorphism problem, to make its signatures unusually small and fast. That efficiency was its selling point, and in cryptography efficiency and exposure are often two ends of the same lever. The more structure you build into a scheme to make it fast, the more surface you give an attacker who can find a way to exploit that structure. What Claude Mythos found was exactly that: a symmetry in HAWK's construction that the human cryptographers who had studied the scheme for two years had not spotted, and which turned the scheme's cleverness into its weakness.

This is the reason NIST's selection process is conservative to the point of looking slow. Faced with a fast, clever candidate and a slower, more heavily analysed one, the standards process favours the design whose security rests on the most studied assumptions with the least exploitable structure, even at the cost of larger signatures. HAWK was the clever option that stayed in the workshop. The scheme KXCO uses is the conservative option that became the standard. The Mythos result is, in effect, a vindication of that caution.

03Why KXCO is not in the blast radius

Now the direct question. Does KXCO use HAWK anywhere? No. Not in the chain, not in the signing service, not in the published libraries, not in the transport layer. KXCO's post-quantum stack is built on the algorithms NIST actually finalised, not the ones still competing to qualify. Signatures are ML-DSA-65 (the standard formerly known as Dilithium, published as FIPS 204). Key exchange is ML-KEM (FIPS 203). These are the schemes that Armature L1 has run from its genesis block, that KXCO Sign uses to seal every signing session, and that sit behind the hybrid post-quantum TLS protecting KXCO's live services.

You do not have to take that on trust. When this research broke, the first thing we did was the boring, correct thing: we searched the entire codebase for any use of HAWK or its cousin Falcon, across the chain, the signing service, the open-source packages and the transport configuration. There are none. The only matches for the word "Falcon" anywhere in the estate refer to an unrelated large language model in our research data, not the signature scheme. KXCO's cryptographic surface is ML-DSA-65 and ML-KEM, and the attack does not touch either.

It does not touch them because the mathematics does not carry across. ML-DSA is built on the module learning-with-errors and module short-integer-solution problems, assumptions that are older, more conservative, and far more heavily scrutinised than the lattice isomorphism structure HAWK relied on. The symmetry Claude Mythos exploited in HAWK simply does not exist in ML-DSA's construction. This is not a hopeful guess about a scheme that might also fall later. It is the specific reason NIST chose ML-DSA as the standard and left HAWK in the candidate pool: fewer moving parts for an attacker to grip.

Interactive · drag nodes, hover to inspect, Run scan to trace the attack. The scan fans out from Claude Mythos into the schemes it actually reached: the HAWK candidate and reduced-round AES. The KXCO cluster on the right, secured by the finalised NIST standards, sits outside the attack's reach. Rendering is illustrative; live network parameters are always at chain.kxco.ai.

04The AES result, in proportion

The AES finding deserves its own short section, because it is the one most likely to be misread by someone skimming. Reduced-round cryptanalysis is a normal and healthy part of how ciphers are studied. Researchers routinely attack cut-down versions of a cipher, with fewer rounds than the real thing, precisely to measure how much safety margin the full version has. A faster attack on 7-round AES-128 tells cryptographers something useful about that margin. It tells a business running full 10-round AES essentially nothing about its own exposure, because the full cipher is not the thing that was attacked.

KXCO's transport security uses full-round AES in its authenticated-encryption modes, the same as the rest of the internet. The Möbius Bridge result does not apply to it. What the result does show, and this is the thread that runs through the whole story, is that an AI system was able to invent a genuinely novel cryptanalytic technique. The technique's target was academic. The capability behind it is not.

05The real story: cryptanalysis just got cheap

Strip away the specific algorithms and here is what Claude Mythos actually demonstrated. An AI system found a real structural flaw in a serious cryptographic scheme in about 60 hours, at a compute cost of roughly 100,000 US dollars. Human experts had studied the same scheme for two years and missed it.

Read that again, because it is the whole point. Two years of specialist human review, beaten by a machine over a long weekend, for the price of a mid-range car. The cost of finding weaknesses in cryptography just fell off a cliff, and it fell at the precise moment when quantum computing is edging closer to threatening the old algorithms from the other direction. Organisations that still rely on classical encryption are now squeezed between two trends at once. AI is accelerating the discovery of attacks. Quantum is expanding the set of things that can be attacked.

This is where the phrase "harvest now, decrypt later" stops being a slogan and starts being a schedule. Anything encrypted or signed today that must remain confidential or valid for a decade is already inside the exposure window, because an adversary can capture it now and wait for the tools to catch up. The Mythos research does not create that risk. It is a public, dated confirmation of how fast the tools are catching up. The trend line has a direction, and the direction is not comforting for anyone still deferring the migration.

06Why this makes KXCO matter more, not less

It would be easy to read a story about AI breaking cryptography as bad news for a company that sells cryptography. It is the opposite, and the reasons are worth stating plainly, because they are the reasons KXCO was built the way it was.

Standards discipline

The clearest lesson from HAWK is that experimental schemes fail, sometimes suddenly and sometimes to an attacker nobody anticipated. KXCO does not gamble on candidates. It ships the algorithms that have already survived the gauntlet: ML-DSA-65 and ML-KEM, at NIST security Category 3, the levels the standards process selected. If you build on KXCO, you inherit that discipline by default, rather than having to enforce it with a cryptography team you may not have.

Crypto-agility

The deeper lesson is that no single algorithm should ever be treated as permanent. What matters almost as much as which algorithm you use today is how quickly you could change it tomorrow. KXCO's architecture treats the algorithm as something that can be rotated rather than something welded into every product. KXCO Sentinel and the PQC host are built so that upgrading the underlying cryptography is an operational task, not a ground-up rebuild. If the field shifts again, and it will, that agility is what lets you move with it instead of being trapped by a decision you made years earlier.

Hybrid defence

KXCO's transport security does not bet everything on the new mathematics. It runs classical and post-quantum protection together, so an adversary has to defeat both to get anywhere. If the post-quantum half were ever weakened, the classical half still holds against a conventional attacker, and the reverse is true against a quantum one. That belt-and-braces posture is exactly the hedge a story like Mythos argues for. It is the practical expression of not trusting any one scheme too much.

07What to actually do now

If you are responsible for protecting client data, documents, payments or identity, the right response to the Mythos news is not to panic about post-quantum cryptography. It is to stop deferring the move to it, and to make sure that when you move, you move onto finalised standards with a clear path to upgrade later. The sequence is the same one KXCO applies internally.

1. Scan. Run Bastion, part of KXCO Sentinel, across your code, dependencies, containers and transport to find where you still rely on RSA, ECDSA and other quantum-vulnerable cryptography. You cannot migrate what you have not found, and most estates have no accurate map.
2. Inventory. Produce a cryptographic bill of materials, the cryptography analogue of a software bill of materials, so the migration becomes a tracked programme rather than a guess.
3. Migrate, hybrid-first. Move signing to ML-DSA-65 and key exchange to ML-KEM, keeping classical and post-quantum side by side so you can roll out incrementally and roll back safely. Treat crypto-agility as a permanent property, not a one-time switch.
4. Attest. Sign the migration state so it is provable to an auditor or a counterparty, not merely asserted.
5. Anchor and verify. Anchor the artefacts that must stay verifiable for years to Armature L1, and check signatures with the open-source @kxco tooling, with no KXCO server in the loop.

None of this is a fire drill. The point of doing it now, calmly, is that the alternative is doing it later, under pressure, after the trend line the Mythos research just confirmed has moved further in the direction it is already going.

08What we claim, and what we don't

Consistency with the argument demands the same honesty we ask of everyone else's quantum marketing.

KXCO is a software company operating in the UK and USA. It holds no financial licences and does not custody assets. The institutions that deploy KXCO software operate under their own licences and hold the relationships with their own customers.

09Frequently asked questions

Did Claude Mythos break post-quantum cryptography?

No. It weakened HAWK, an experimental candidate that was never selected as a NIST standard. The finalised standards, ML-KEM and ML-DSA, were not affected, and Anthropic coordinated its HAWK disclosure with NIST.

Is KXCO affected?

No. KXCO uses ML-DSA-65 and ML-KEM, not HAWK. HAWK rests on a different mathematical structure, and the symmetry Mythos exploited does not exist in the problems ML-DSA is built on. There is nothing in the KXCO stack to change.

Is AES broken now?

No. The result speeds up an attack on a reduced, 7-of-10-round version of AES-128, and still needs an impractical amount of data. Full AES, including the modes KXCO uses, is not affected.

If ML-DSA is fine, why does any of this matter to me?

Because it proves AI can now find real cryptographic flaws cheaply and fast. That raises the urgency of migrating off classical encryption and onto standards-based, upgradeable post-quantum infrastructure, before the tools improve further.

Do I have to trust KXCO to believe any of this?

No. The algorithms are the published NIST standards, the verification tools are open source, and Armature has a public explorer. Check a signature yourself; read the chain yourself.