ANALYSIS: Anthropic Claims to Be Making Progress in Post-Quantum Cryptanalysis, and No One Is Verifying It

An existing attack accelerated, not a new vulnerability

The second finding published by Anthropic concerns a 200- to 800-fold acceleration of an already known attack, known as “meet-in-the-middle,” applied to a reduced version of AES-128—limited to seven rounds out of the standard encryption’s ten rounds. This distinction is crucial: this is not a newly discovered vulnerability, but rather an optimization of an attack method already documented by the cryptographic community.

The claimed acceleration eliminates a step involving an exhaustive search of 256 possibilities, which reduces the computational cost of the attack without making it feasible against the full 10-round version of AES-128 used in production.

Why This Distinction Changes Everything

The difference between attacking a seven-round version of AES-128 and attacking the full ten-round version of AES-128 is not a minor technical detail: it distinguishes a theoretical research demonstration from a real threat to encryption systems actually deployed around the world. Breaking a reduced version of an algorithm is not the same as breaking the algorithm itself. The gap between the two is measured in years of research, not in press releases.

Anthropic itself acknowledges this limitation: the AES attack requires a number of chosen plaintexts that, in its own words, remains impractical in the context of a real-world attack against a production system.

A benchmark published nine days before the announcement

These results follow the July 20, 2026, release of CryptanalysisBench, a benchmark comprising 191 tasks developed jointly by researchers from ETH Zurich, Anthropic, the University of Haifa, the Technische Universität Berlin, and Tel Aviv University. This academic collaboration lends broader methodological legitimacy than if Anthropic had produced this benchmark on its own.

On this benchmark, five models succeeded in breaking between 65% and 86% of first-level schemes—a result that, when viewed in the context of the HAWK-256 announcement, suggests a broader trend of progress in AI models for automated cryptanalysis.

What this academic context does not change

The participation of academic researchers in developing the benchmark does not mean that the specific results on HAWK-256 and reduced AES-128 have themselves been validated by an independent external audit. This distinction between the legitimacy of the measurement tool and the validation of the measured result remains central to properly assessing the scope of the announcement.

A credible collaborative benchmark can coexist with specific results that are published solely by the company claiming them—a situation that calls for caution without invalidating the research itself.

HAWK Remains a Third-Round Candidate

As of July 29, 2026, the date of publication by The Hacker News, NIST continued to list HAWK as a third-round candidate in its post-quantum standardization process, with no public mention of any reevaluation related to Anthropic’s results. This lack of an official response does not mean that NIST rejects Anthropic’s findings, but it does indicate that no formal reassessment of HAWK’s status had yet taken place at the time of this publication.

NIST’s cryptographic standardization processes typically follow review cycles that take several months, a timeframe that partly explains the lack of an immediate response, though it does not guarantee that HAWK will retain its current status in the long term.

Why NIST’s Silence Matters as Much as the Announcement Itself

The silence of a leading authority like NIST in the face of an announcement of this magnitude is, in itself, a piece of information: either NIST has not yet had time to examine the results, or its initial assessment does not deem an immediate response necessary. The silence of a leading authority is never a verdict. It is, at best, a pause preceding a judgment yet to come.

This lack of reaction should encourage caution in interpreting the true scope of the claimed discovery, rather than leading to an alarmist or triumphalist reading of the figures published by Anthropic alone.

No production systems were affected, according to the company

Anthropic explicitly states that none of these findings affect current production systems: the HAWK attack remains exponential, not a polynomial-time breakthrough, and the AES attack requires a number of chosen plaintexts that remains impractical under real-world conditions. This caveat, provided by the company itself, significantly tempers the immediate practical impact of the announcement.

In cryptography, an improved exponential break remains fundamentally different from a polynomial break: the former makes an attack faster without making it feasible on a large scale, while the latter would change the very nature of the security of the scheme in question.

Why This Nuance Often Gets Lost in Media Coverage

The distinction between an exponential improvement and a polynomial breakthrough, while central to assessing the actual significance of this announcement, does not lend itself well to a catchy headline, which explains why some media reports may have presented these results as a more immediate threat than they actually are, according to Anthropic’s own terms. A headline that simplifies a cryptographic nuance is not necessarily false. It is, more often than not, simply incomplete.

This analysis chooses to preserve the technical nuance rather than oversimplify it, in keeping with the approach that distinguishes a rigorous analysis from a mechanical regurgitation of a press release.

A research paper published with reproducibility artifacts

These are research results published by Anthropic itself, accompanied by reproducibility artifacts that, in theory, allow independent third parties to verify the presented calculations. This methodological transparency distinguishes this announcement from mere unsubstantiated claims and constitutes a standard of good scientific practice that not all companies consistently follow.

However, the availability of reproducibility artifacts does not guarantee that a third-party verification has already taken place at the time of this publication; it only guarantees that such a verification is technically possible for anyone who wishes to undertake it.

The interpretation of the scope remains a company statement

The factual record, carefully established in the documentation reviewed for this analysis, specifies that the interpretation of the scope of these results—particularly the assertion that no production systems are affected—remains a statement by the company in question, not a conclusion validated by an independent external body. This distinction does not call into question Anthropic’s good faith, but it serves as a reminder of a basic methodological rule: a company that publishes research on its own capabilities is never the most neutral evaluator of their scope.

Applying this rule to Anthropic does not constitute different treatment from that given to other technology companies; it is the same requirement for independent verification that should apply to any announcement of a technical breakthrough, regardless of its source.

Additional pressure on candidates currently under evaluation

If Anthropic’s findings are confirmed by independent third parties, they would add further pressure to NIST’s post-quantum standard selection process, at a time when several candidates are already undergoing thorough scrutiny to identify potential weaknesses before their widespread adoption. This pressure would be part of the normal course of the standardization process, whose very purpose is to eliminate vulnerable schemes before their large-scale deployment.

Such a result, if confirmed, would not call into question the post-quantum standardization process itself; on the contrary, it would reinforce its value by demonstrating its ability to detect weaknesses before a vulnerable scheme is widely adopted.

Artificial Intelligence as a New Tool for Cryptanalysis

Beyond the specific case of HAWK-256, this announcement is part of a broader trend: the use of artificial intelligence models as research tools in cryptanalysis, a practice that could accelerate the detection of weaknesses in cryptographic schemes, whether post-quantum or classical. Artificial intelligence that helps break cryptographic schemes can also help build more robust ones. The tool is not limited to one side.

This dual capability—to attack and to defend—places companies developing these models in a unique position, where their own discoveries of vulnerabilities warrant even more rigorous third-party scrutiny, especially since they stem from the very tool that could, in the future, be sold as a defense solution.

Past cryptographic announcements that required months of verification

The history of cryptanalysis contains several precedents in which initial announcements of breakthroughs required months, or even years, of independent verification before being fully confirmed or, in some cases, scaled back from their initially announced scope. This historical precedent does not invalidate Anthropic’s research, but it does justify exercising the same degree of caution before considering these results definitively established.

The cryptographic community has rigorous peer-review mechanisms precisely because validating a theoretical attack requires a meticulous examination of assumptions, implementations, and experimental conditions—a process that cannot be rushed, even in the face of a media-sensationalized announcement.

What this caution does not prevent us from acknowledging

Recognizing the uncertainty surrounding the exact scope of this discovery does not preclude commending Anthropic’s methodological transparency, as the company chose to publish its reproducibility artifacts rather than settle for an unverifiable announcement. This transparency distinguishes responsible research practice from a mere commercial publicity stunt.

Methodological caution and the recognition of best practices are not mutually exclusive: it is possible to commend Anthropic’s approach while refusing to treat its own conclusions about the scope of its discovery as definitively established facts.

The facts firmly established by available sources

Several elements of this case are firmly established: the publication of results by Anthropic between July 20 and 28, 2026; the precise figures for the reduction in the work factor for HAWK-256, HAWK-512, and HAWK-1024; the claimed acceleration on AES-128 reduced to seven rounds; and HAWK’s unchanged status at NIST as of July 29, 2026. These factual elements are not disputed by the sources consulted for this analysis.

What remains open, however, is the complete independent validation of these results by third parties outside of Anthropic, as well as any formal reassessment of HAWK’s status by NIST in light of these new results.

The verdict of this analysis, stated precisely

This analysis classifies the results on HAWK-256 and reduced AES-128 as published research containing reproducibility artifacts—partially verifiable—but whose interpretation of practical significance remains, to date, a statement by the company in question rather than a conclusion validated by an independent third-party audit or an official NIST reassessment. A published finding supported by evidence deserves to be taken seriously. However, it does not deserve to be taken at face value before it has been verified.

This status could change if independent researchers reproduce Anthropic’s results, or if NIST publishes a formal reassessment of HAWK’s status in light of this announcement.

Signs to Watch for in Resolving This Issue

Several developments in the weeks following this publication could provide a better assessment of the actual significance of this announcement: an official response from NIST regarding HAWK’s status, an independent reproduction of the artifacts published by Anthropic, or responses published by other researchers in post-quantum cryptography. Each of these indicators would provide a level of confirmation that the current case does not yet have.

The absence of such indicators in the coming weeks would not necessarily mean that Anthropic’s results are false, but it would raise questions about the actual pace of independent verification in response to an announcement of this magnitude.

What Organizations Using Post-Quantum Cryptography Should Take Away

For organizations considering the adoption of post-quantum cryptography schemes, the practical lesson from this analysis is to monitor the official status of the candidates as determined by NIST rather than reacting immediately to every research announcement, no matter how impressive it may seem at first glance. NIST will make its decision in due course. In the meantime, panic is not a security strategy.

This measured approach does not mean ignoring legitimate warning signs, but rather treating them with the methodological rigor that their actual significance warrants—no more, no less.

A competitive arena that goes beyond the Anthropic case

This case study illustrates a broader dynamic in which several artificial intelligence labs are seeking to demonstrate the capabilities of their models in highly technical fields such as cryptanalysis—an arena that offers considerable scientific visibility in the event of a positive result. This competition among labs is not unique to Anthropic and shapes the way these results are announced and covered by the media.

Understanding this competitive dynamic helps contextualize the timing of this announcement’s release, without calling into question the potential validity of the underlying scientific results.

The Responsibility for Independent Verification in the Face of This Competition

In this context of competition among laboratories, the responsibility for independent verification becomes all the more crucial: the faster announcements of technical breakthroughs multiply, the more the scientific and journalistic communities must resist the temptation to validate them immediately without thorough examination. The race among laboratories produces announcements faster than it produces verifications. It is in this gap that this case remains in limbo.

This responsibility for verification does not rest solely with journalists and external researchers; it also rests, in large part, with the companies themselves, which should actively encourage independent scrutiny of their own results rather than simply publishing them with technical details without seeking active external verification.

A recurring pattern in the artificial intelligence industry

This pattern of publishing internal research, followed by widespread media coverage before any comprehensive independent validation, is not unique to Anthropic: it characterizes much of the scientific communication in the contemporary artificial intelligence industry. This recurrence does not absolve Anthropic of the responsibility to clarify the limitations of its own discovery, but it places this case in a broader context than that of an isolated incident.

Companies that publish research results on their own models would be well advised, according to the methodology applied in this analysis, to actively seek external validation before or concurrently with the media release of their results, rather than leaving this validation entirely to unsolicited third parties.

What This Means for Readers of Such Announcements

For readers encountering this type of announcement, the rule of thumb remains simple: systematically distinguish between what a company publishes about its own capabilities and what an independent third party has confirmed, regardless of the apparent quality of the methodological transparency displayed. Data transparency does not equate to neutrality in interpretation; the two must be verified separately.

This rule is not intended to discredit Anthropic or any other company publishing similar results; it simply serves as a reminder of the basic approach to any critical reading of a scientific announcement accompanied by a commercial or reputational stake for the company making the claim.

A Useful Comparison with Other Recent Announcements

Other recent announcements of technical breakthroughs in artificial intelligence applied to security have followed a pattern similar to the one observed here: a company publishes its own results, accompanied by technical data, before a comprehensive independent audit confirms or qualifies the claimed scope. This comparison helps set realistic expectations regarding the time required for a full verification of Anthropic’s announcement.

Each case has its own technical specifics, but the general pattern—rapid announcement, slow verification—seems to recur often enough in the industry to serve as a useful rule of thumb for any serious observer of the sector.

What This Pattern Teaches Us About How to Interpret Such Announcements

In light of this pattern, the only methodologically defensible approach is to treat each new announcement according to the same protocol: identify what is documented, what is claimed, and what remains undetermined due to a lack of third-party verification. The protocol does not change based on the prestige of the lab making the announcement; it must be applied consistently, or it is meaningless.

It is this protocol, applied systematically throughout this analysis, that allows us to distinguish a rigorous interpretation from a mere enthusiastic or skeptical repetition of the original press release.

This analysis draws a clear distinction between what Anthropic claims and what independent sources confirm as of July 29, 2026. The specific figures for the reduction in the work factor for HAWK-256, HAWK-512, and HAWK-1024, as well as the claimed speedup on reduced AES-128, have been published alongside reproducibility artifacts—a standard of transparency that deserves recognition. However, the interpretation of their practical significance remains, to date, a claim by the company in question, unconfirmed by an independent third-party audit or an official reassessment by NIST.

This distinction in no way diminishes the potential importance of this research for the post-quantum cryptography ecosystem, but it serves as a reminder that a publication accompanied by impressive technical artifacts does not, on its own, equate to full validation by the broader scientific community. The process of cryptographic verification, by its very nature, takes longer than the media announcement cycle. As of July 29, 2026, HAWK remains a third-round candidate. NIST has not yet commented, and it is this silence that should prompt caution.

The coming weeks will reveal whether independent researchers can reproduce Anthropic’s results, and whether NIST deems it necessary to reassess HAWK’s status in light of this announcement. This analysis will be updated based on these developments, using the same verification method applied here since the initial publication. A cryptographic discovery is confirmed by reproduction, not by the authority of the announcer alone.

Until then, caution dictates that every figure in this report be treated according to its actual status: a documented research result, accompanied by technical evidence, but whose practical significance remains, for now, an assessment made by the party with the greatest stake in demonstrating its importance. Between published research and independent validation lies a gap that scientific rigor must acknowledge, not bridge with premature enthusiasm.

What this analysis concludes with certainty is that Anthropic has published serious, well-documented, and partially reproducible research on potential weaknesses in HAWK-256 and the reduced version of AES-128. What this analysis cannot yet establish is that these weaknesses pose an immediate practical threat to production systems—a conclusion that even Anthropic itself refrains from making in its own words. Rigor consists in repeating what the source itself admits it does not yet know, rather than exaggerating beyond what it asserts.

For methodological reasons, this report will remain classified as “partially verified” until independent third-party confirmation or a formal response from NIST resolves the question of its actual scope. A reduced work factor on paper is not yet a broken key in the real world. The difference between the two lies in the work that remains to be done.

This analysis seeks neither to exaggerate nor to downplay Anthropic’s announcement: it seeks only to situate it precisely between published research and confirmed evidence, as of the date these lines are written. This is the only tenable position when faced with a company that claims a major breakthrough in its own competitive arena. Being wary of an announcement is not the same as rejecting it. It means refusing to treat it as a certainty before it becomes one.

The next chapter of this story will unfold at the pace set by NIST and the international cryptography community, not at the pace of the media cycle that carried this announcement on July 29, 2026. Post-quantum cryptography is built on decades of verification. An announcement, even a well-documented one, represents only a single line in that story.

By Maxime Marquette, columnist