Agents Cracked the Cipher: What Businesses Need to Know About Anthropic's Mythos

A few weeks ago, Anthropic announced something cryptographers had long warned about in theory but no one was prepared for in practice: Claude Mythos — the company's new AI model — independently discovered mathematical vulnerabilities in the encryption algorithms that protect the entire modern internet. Not code bugs. Not human errors in implementation. Weaknesses in the mathematical foundations themselves. This isn't another cybersecurity breach report. It's a change in the rules of the game.

What Mythos Actually Did — and Why It Matters

Anthropic described two specific discoveries. First: Mythos found an improved attack method against HAWK — a post-quantum digital signature scheme currently under consideration at NIST as a potential U.S. federal standard. According to Anthropic, the model identified a previously unknown mathematical symmetry in HAWK's underlying lattice structure and used it to recover encryption keys faster than any known method. Specifically: the cost of attacking the smallest key dropped from 2⁶⁴ to 2³⁸ operations — effectively cutting the scheme's security level in half.

The second discovery concerns AES — the cipher standardized by NIST back in 2001 and still the most widely deployed standard for protecting data in transit. Mythos developed a new mathematical technique researchers called "Möbius Bridge," accelerating attacks on a seven-round version of AES by 200–800x compared to the record set by cryptographers in 2013.

Both results were achieved largely autonomously. As Anthropic reported, one company researcher spent a week working alongside Claude to develop the HAWK attack, while another built a scaffold that allowed Mythos to discover the AES attack entirely on its own — with no further human input. Each result cost approximately $100,000 in API calls, and a few hundred person-hours were needed for just one thing: confirming the findings were real.

Why This Isn't "Just Research"

Anthropic is clear: neither discovery poses a threat to production systems today. HAWK isn't deployed in production yet, and the AES attack only works against a seven-round research variant — not the full ten-round cipher used in real-world systems. But the underlying logic has shifted.

Before Mythos, cryptanalysis — the process of finding weaknesses in algorithms — took years of work from the world's best mathematicians. Mythos found the core idea for an AES attack in a matter of days. Anthropic admitted that its own researchers spent several hundred hours just understanding the mathematics the model had proposed — and verifying it was correct. The machine made the breakthrough; humans scrambled to catch up and check whether it was right.

For business, this means one thing: the buffer that once existed between "theoretical vulnerability" and "real threat" is shrinking fast.

The Scale of the Threat: What's Already in the Crosshairs

Alongside its cryptographic discoveries, Mythos is demonstrating capabilities that would have seemed like science fiction just a few months ago. During internal testing, Anthropic reports the model found vulnerabilities in every major operating system and every major browser. Within two weeks of a limited release, Mozilla announced it had identified and patched 271 vulnerabilities in Firefox — found using Mythos.

Anthropic also ran a test against 100 known CVEs in the Linux kernel from 2024–2025. The model filtered out 40 as potentially exploitable — and successfully converted more than half of those into working privilege-escalation exploits, writing each one fully autonomously after a single initial prompt.

According to Turing Institute researchers, more than 45% of discovered vulnerabilities in large organizations remain unpatched for 12 months or longer. Now there's a new dimension added to that backlog: vulnerabilities humans haven't found yet, but AI already can.

Who This Affects Right Now

The corporate risk isn't abstract. HAWK is being considered for securing digital signatures in financial transactions, government systems, and blockchain solutions. AES protects HTTPS traffic — which means literally every corporate communication, every API call between your services, every session in every SaaS product your team uses.

Mythos does not break current full-strength AES encryption — that's a critical distinction. But the logic of the situation is different: if an AI model found something for $100,000 in API costs that mathematicians hadn't seen for years, the question "when will someone apply a similar approach against us?" stops being paranoia and becomes an operational risk.

Project Glasswing: How Anthropic Is Answering the Risks It Helped Create

Anthropic didn't just publish the results — it formed the Project Glasswing consortium, which reportedly includes AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, and Nvidia, later joined by NATO and the EU's cybersecurity agency ENISA.

The consortium's goal: put Mythos in the hands of those who can use it defensively, before comparable capabilities emerge from less responsible actors. Access to the model comes with strict security requirements; Mythos remains unavailable to the broader market, with Anthropic explicitly stating that the potential for large-scale AI-powered cyberattacks is too serious to ignore.

Anthropic also developed CryptanalysisBench — a set of 191 cipher-breaking challenges drawn largely from NIST competitions. Mythos 5 solved 85.7% of problems with known solutions. The weakest model in the benchmark managed 65.3%. This isn't just a performance advantage — it's a different league entirely.

What This Means for the Corporate Landscape

Anthropic has warned that within 6–12 months, other companies will likely have models of comparable capability — and some may release them without equivalent safeguards. This isn't an analyst forecast. It's Anthropic's own assessment of its competitors.

For a business leader, this implies a concrete timeline: not "sometime in the future," but roughly within the next year, the threat environment could shift qualitatively. Companies that haven't begun auditing their cryptographic infrastructure now risk finding themselves forced to make changes in crisis mode.

A Practical Risk Map: What to Review Today

The good news: both of Mythos's discoveries give business time to prepare rather than demanding an immediate rebuild. The bad news: that time is finite — and most companies are spending it on the wrong things.

Here's where to focus first.

Cryptographic inventory. Management rarely knows exactly where and which encryption algorithms are being used inside the organization. As Ellen Boehm, Senior Vice President of AI Strategy at Keyfactor, told CyberScoop, Anthropic's findings underscore the need for organizations to "have visibility into where cryptography exists inside the enterprise, and which business systems and processes it's connected to." Without that audit, everything else is flying blind.

Post-quantum readiness. If HAWK gets revised or rejected by NIST following Mythos's findings, it will affect the standards choices for companies already planning migration. The UK's NCSC has published a roadmap calling for critical sectors to transition to post-quantum cryptography by 2035; the EU has set a 2030 target. Organizations starting this journey now still have time to make it orderly.

Triage velocity. One of the most underappreciated problems isn't the absence of detected vulnerabilities — it's the inability to process them. Based on Anthropic's data, a vulnerability backlog that previously demanded three months of SOC team effort can now be cleared in a week with AI tooling. This changes the calculation entirely: not "how many vulnerabilities do we have," but "are we closing them faster than someone else is finding them."

For Small and Mid-Sized Businesses — a Specific Risk

Large enterprises have access to Project Glasswing, or at minimum the resources for an internal audit. Most small and mid-sized businesses have neither. Yet they're running the same SaaS products, the same cloud providers, the same libraries. The risk isn't smaller — it's just less visible.

A minimal starting plan: review which cryptographic libraries are used in your products or by vendors you trust with critical data; ask key suppliers about their PQC roadmap; and start building a shared understanding within your team that the question is no longer "do we have vulnerabilities" but "how quickly do we find and close them."

When you have clear answers to these questions, it's not just security. It's the feeling of actually being in control of your business — rather than constantly managing in "what if something blows up" mode.

What Businesses Should Not Do: Common Mistakes

The first mistake is relaxing too early because of the phrase "does not threaten production systems today." That doesn't mean "safe forever." It means "there's time to prepare" — and that time isn't unlimited.

The second mistake is treating this as purely an IT department problem. Decisions about migrating cryptographic standards involve budgets, priorities, vendors, and timelines. That's a COO and CEO conversation, not just a CISO one.

The third mistake is waiting for the regulator. Anthropic itself has warned that other market players may release models of comparable capability without equivalent restrictions. Regulators will respond — but reactively, and late. Businesses that form their own position now will have an advantage: not because they're "doing the right thing," but because they'll be ready.

The fourth mistake is ignoring the topic in communications with investors and the board. Today, the question "how are you managing cryptographic risks in the age of AI" is becoming standard due diligence. Executives who can give a clear, structured answer — with a dependency map, a PQC plan, and a real understanding of threat vectors — come across very differently from those who are hearing about Mythos for the first time at a board meeting. That's not a minor detail. It's the difference between "risk asset" and "trusted leader" in the eyes of investors.

The Bigger Picture: Where AI in Security Is Heading

Mythos's discoveries don't stand alone — they're part of a larger shift. Back in 2025, the AISLE research organization documented the discovery of 15 CVEs in OpenSSL (including all 12 vulnerabilities in one security release, some of which had existed for over 25 years) and more than 180 CVEs across 30+ projects spanning cryptography, middleware, and the application layer.

This is the new normal: AI systems no longer just help find bugs — they can conduct cryptanalysis at a level that previously required a team of leading specialists and years of work. As Anthropic wrote in its communication to the community, "the security community is now confronting the fact that language models are capable of finding so many bugs that standard human processes — triage, verification, remediation — cannot keep pace."

This isn't a call to panic. It's a call to systemic thinking. Companies that are already shifting their security posture from reactive to proactive — with a clear registry of cryptographic dependencies, automated monitoring, and a PQC roadmap — gain something beyond protection. They gain predictability: they know where their weaknesses are, they know the plan to address them, and they don't depend on who finds those weaknesses first — a friendly researcher or a hostile actor.

For a deeper look at how to approach the secure deployment of AI agents in enterprise environments, see Autonomous Hacking of Hugging Face: Why Business Leaders Need to Understand AI Agent Risks. And if you're interested in the context around blocking and the return of Anthropic models, read Anthropic Brought Back Claude Fable 5 and Mythos 5: What It Means for Your Business After the Cybersecurity Pause.

---

FAQ

Did Mythos break real encryption currently in use? No — and that distinction matters. Anthropic is explicit: neither discovery affects production systems today. HAWK is not yet standardized, and the AES attack only works against a seven-round research variant of the cipher, while real-world systems use the full ten-round version. That said, the fact that AI found these vulnerabilities faster than any human team changes the risk calculus for the future.

Is Claude Mythos available to businesses? Anthropic has deliberately not made Mythos publicly available due to misuse concerns. Access has been granted only to Project Glasswing consortium members — primarily large technology companies and cybersecurity agencies operating under strict security requirements. For most businesses, Mythos remains out of reach directly, though its impact on security standards is already being felt through the actions of major vendors.

What should small and mid-sized businesses do right now in response to Mythos? Three practical steps: conduct an inventory of which cryptographic libraries and algorithms are used across your infrastructure and by your key SaaS vendors; ask critical suppliers about their post-quantum transition plan; and rethink vulnerability triage — not as a one-time check, but as an ongoing operational process with measurable response-time metrics.

---

Mythos's findings are not a reason to stop and wait. They're a reason to spend the next few weeks moving from an intuitive sense of "we're probably fine" to a concrete understanding of exactly where your cryptographic defenses stand — and what happens if a model like Mythos appears tomorrow, but without Anthropic's guardrails.

How would you currently rate the visibility of cryptographic dependencies in your organization — and is there someone on your team who can give a clear answer to that question? Leave a comment below or reach out directly. This is exactly the kind of conversation worth starting now.