Claude Mythos Cracked Post-Quantum Cryptography That Humans Spent Years Failing to Break

We have been talking about the 'quantum apocalypse' for years like it was some distant science fiction event. The fear was that one day, a quantum computer would get powerful enough to shred every password and private key on the planet. To prevent this, developers have been working on Post-Quantum Cryptography (PQC). These are math problems so hard that even a quantum computer shouldn't be able to solve them.

But we did not expect an AI to get there first. A version of Anthropic's Claude, specifically a model called Claude Mythos, just broke a post-quantum signature scheme that was on the fast track for federal standardization in the United States. This is not just a bug report; it is a wake-up call for anyone building in crypto and AI.

The Mythos Discovery

For a long time, the cryptographic community has relied on human intuition and peer review to stress-test security. The National Institute of Standards and Technology (NIST) runs multi-year competitions to find the best algorithms. The winners become the global standards for how we protect bank accounts, government secrets, and blockchain wallets.

Claude Mythos was tasked with analyzing one of these sophisticated candidates. Using a technique called automated formal verification, the model identified a structural vulnerability that human cryptographers had missed for years. It found a way to bypass the security assumptions of a system specifically designed to resist the most powerful computers in existence.

This is a foundational shift. Usually, when an algorithm is broken, it happens because of a 'eureka' moment from a brilliant mathematician or a massive brute-force attack. In this case, it was a language model using logic to dismantle a complex mathematical safeguard. It found a shortcut around the wall we spent a decade building.

Why Builders Should Care

If you are building in the crypto space, your entire business model relies on the assumption that certain math is 'unbreakable.' We trust ECDSA and RSA because they have stood the test of time. But the emergence of AI changes the timeline of 'time-tested' security. A model can simulate thousands of years of human trial-and-error in a fraction of the time.

For founders, this means your threat model just got a lot more complicated. We are no longer just worried about a state actor with a billion-dollar quantum computer. We now have to worry about an AI that can be run for a few dollars an hour, looking for holes in our foundational code. If an AI can break a NIST-level post-quantum algorithm, it can certainly find vulnerabilities in your smart contracts or your identity layer.

The Skeptical Take

As much as this sounds like a win for AI, it is also a massive liability. If AI is the one finding the holes, who is to say it isn't also the one creating them? There is a growing concern that as we use AI to help write code, we are introducing subtle patterns that other AIs can exploit. We are essentially building a house with tools that know exactly where the structural weaknesses are.

Also, let's be honest about the 'locked' nature of these models. Anthropic kept Mythos behind closed doors for a reason. When a model becomes capable of breaking high-level encryption, it becomes a weapon. The delta between 'helpful research assistant' and 'automated cyberwarfare tool' is incredibly thin. Builders need to stop looking at AI as just a productivity tool and start seeing it as a dual-use technology that could invalidate their security stack overnight.

The Impact on Standardization

NIST and other regulatory bodies now have a problem. The standard process for vetting encryption takes years. By the time a human committee approves an algorithm, the AI landscape has shifted three times over. We are entering an era where the 'standard' might be obsolete before the ink is dry on the documentation.

This suggests we need to move toward 'cryptographic agility.' This is the idea that your system should be able to swap out its encryption methods as easily as you swap a battery. If Claude Mythos can break an algorithm today, we need to be able to deploy a new one tomorrow without rebuilding the entire stack from scratch.

Moving Forward

The lesson here isn't to stop using AI or to stop working on post-quantum security. The lesson is that the 'fortress' mentality of security is dead. You cannot build a wall high enough to keep out an intelligence that evolves every six months. Instead of perfection, we should be building for resilience and fast recovery.

For developers, this means incorporating AI into your red-teaming immediately. If you aren't using these models to try and break your own code, you are leaving the door open for someone else who will. The tools for destruction are becoming democratized, which means the tools for defense must become proactive, not reactive.

Takeaway for Founders

• Audit with AI: Manual audits are no longer enough. You need to leverage models for formal verification to find the logic flaws that human eyes typically miss.
• Design for Displacement: Don't hardcode your security. Ensure your protocols can update their cryptographic primitives without a hard fork or a total rewrite.
• Question the Standards: Just because an algorithm is 'federally approved' doesn't mean it's safe. AI has proven that legacy peer review has blind spots.

We are watching the old guard of cryptography struggle to keep up with the new speed of silicon. It’s an uncomfortable transition, but for those of us building the next iteration of the web, it’s a necessary one to understand.

Read the original at Decrypt →