The arms race between code and codebreakers just accelerated, and the machines are winning both sides.
The Summary
- Anthropic's Claude Mythos discovered faster attack methods on cryptographic algorithms, including weaknesses in a post-quantum digital signature scheme in just 60 hours
- AI can now hunt for security vulnerabilities at machine speed, finding flaws that human cryptographers might take months or years to uncover
- The same technology that threatens encryption can also defend it — whoever builds better AI agents first wins the security game
The Signal
Claude Mythos cracked weaknesses in post-quantum cryptography in 60 hours. That's the timeframe that matters. Not months of graduate student research. Not years of cryptanalysis conferences. Sixty hours of an AI agent grinding through mathematical possibilities until it found the break points.
Post-quantum cryptography isn't some theoretical nicety. It's the foundation being laid right now to protect data from quantum computers that will render today's encryption obsolete. The signature schemes Claude attacked are designed to survive in a world where quantum processors can factor large numbers instantly. If AI can find weaknesses in quantum-resistant crypto before quantum computers even arrive at scale, we have a sequencing problem.
"AI's rapid vulnerability detection in cryptographic schemes highlights its potential to revolutionize cybersecurity."
The dual-use nature here is stark:
- Attackers can run Claude-class models to find zero-days in production systems
- Defenders can use the same models to stress-test new protocols before deployment
- The advantage goes to whoever can iterate faster, which means whoever has more compute
Anthropic frames this as AI uncovering "hidden security weaknesses" that presumably benefit the good guys. Maybe. But there's no proprietary moat on mathematical insights. Once Claude publishes a faster attack method, every actor with access to frontier models can replicate it. The offensive capability diffuses instantly. The defensive response takes institutional time.
The Implication
Crypto projects building on assumptions about cryptographic hardness need to assume those assumptions have a shelf life measured in AI capability jumps, not decades. Every protocol upgrade, every signature scheme, every zero-knowledge proof needs adversarial AI testing before mainnet. The old model of "we'll patch it when someone finds a bug" doesn't work when someone is a reasoning model running 24/7.
For builders: this is what proactive security looks like in the agent era. You don't wait for the audit. You set your own AI agents to attack your code and see what breaks. Anthropic just showed that the tools exist. Using them is now table stakes.