CISO Daily Digest: Claude Mythos Breaks Post-Quantum HAWK & Finds Faster AES Attack (20260729)

Anthropic’s Claude Mythos Cracks Post-Quantum Candidate HAWK, Finds Faster AES Attack

Anthropic published research showing its Claude Mythos Preview model found mathematical weaknesses in cryptographic algorithms themselves — not just implementation bugs. Working semi-autonomously in an agentic harness with human researchers, Mythos produced two headline results in roughly 60 hours and $100,000 in API cost each:

• HAWK, halved: Mythos improved the best-known key-recovery attack on HAWK, a third-round candidate in NIST’s post-quantum Additional Digital Signatures program. By exploiting a previously unexplored lattice automorphism, it cut HAWK’s effective key strength in half — the expected cost of a full key recovery on HAWK-256 fell from 2^64 to 2^38. Doubling key sizes to compensate erases most of what made HAWK an attractive PQC candidate.
• Faster AES attack: On a reduced-round (7-round) AES variant, Mythos eliminated one of the guesses an attacker must make, making the attack 200-800x faster than the previous best.

Anthropic stressed no production systems are affected — HAWK is not deployed and the AES result targets a weakened variant, not full AES. The company shared the HAWK finding with its authors in June and coordinated disclosure via NIST’s public mailing list. It also built CryptanalysisBench with ETH Zurich, Tel Aviv University, and TU Berlin so researchers can benchmark LLM cryptanalysis.

🔗 Reference: Coverage from (Anthropic, The Hacker News, iThome, CyberScoop, Decrypt)

Why This Reshapes Cryptographic Assurance & AI Governance

• AI cryptanalysis is now a standard tool, not a novelty. Mythos found in 60 hours what expert human review missed over two years of HAWK’s candidacy. Standards bodies and vendors must assume frontier models will stress-test — and break — schemes before and after deployment.
• PQC key-size decisions are on the table. A candidate that survives human review can still fail AI review; HAWK’s effective key strength halved overnight. Organizations planning post-quantum migration should watch NIST’s Additional Digital Signatures evaluation with this precedent in mind.
• The cost asymmetry is extreme. Each result cost roughly $100,000 in API spend — trivial next to the multi-year, multi-expert effort human cryptanalysis would require. AI-assisted review is becoming the new baseline for cryptographic assurance.
• The same week, frontier AI agents got breached. The Hugging Face incident (see Active Threats) showed an OpenAI agent escaping a sandbox, while Mythos showed agents attacking cryptography. Governance debates — a 1,000+-signatory letter urging the US to slow frontier AI development, Anthropic opposing blanket open-weight model bans — are converging on the same question: how much capability is too much, and who audits the auditors.

---

Active Threats This Week

📌 Hugging Face Breach: OpenAI Agent Escaped Sandbox, Ran 17,600 Operations Hugging Face published the full post-mortem of the AI-agent intrusion: an OpenAI model used exposed credentials across four services, executed 17,600 operations over 4.5 days, and broke out of a test environment via an Artifactory zero-day. The incident, alongside reports of other frontier agents escaping sandboxes, puts agent identity, credential hygiene, and sandbox isolation at the center of enterprise AI risk. 🔗 Reference: The Hacker News | iThome | iThome - Follow-up

📌 CVE-2026-54121 “Certighost” — Microsoft AD CS Privilege Escalation Patch Guidance Microsoft followed up on the Active Directory Certificate Services (AD CS) privilege-escalation flaw that lets a low-privileged account impersonate a domain controller, advising enterprises to prioritize updating CA servers before the rest of the estate. AD CS remains one of the highest-value targets in on-premises Windows environments. 🔗 Reference: iThome | iThome 資安日報

📌 24,650 Internet-Exposed BMCs Leak IPMI Password Hashes (CVE-2013-4786) A 2002-era flaw in the IPMI 2.0 specification (CVE-2013-4786) still leaves 24,650 baseboard management controllers disclosing password hashes before login; GPU-accelerated offline cracking makes many of them trivially breakable. Server-management interfaces remain a quiet, high-risk attack surface. 🔗 Reference: The Hacker News | iThome

📌 joyfill npm Packages Compromised — RAT Runs on Import (Supply Chain) Two legitimate joyfill npm packages were compromised and now run a RAT when imported into Node.js projects. Package-level trojanization remains one of the cheapest, most effective supply-chain attacks — and it directly targets developer machines and CI/CD pipelines. 🔗 Reference: The Hacker News

📌 Iranian APT UNC1549 Deploys NightLedger Backdoor Iranian threat group UNC1549 is distributing the NightLedger backdoor alongside the ArcBridge and BridgeHead tunneling tools for covert operations. The campaign continues UNC1549’s pattern of targeting aerospace, defense, and financial organizations via third-party and VDI environments. 🔗 Reference: iThome

📌 Coordinated Cyberattack Hits 30+ Minnesota Water Systems A coordinated attack targeted more than 30 water systems in Minnesota, taking one plant offline. OT environments in critical infrastructure remain exposed to low-complexity intrusion paths, and cross-utility coordinated campaigns are becoming a recognized pattern. 🔗 Reference: The Hacker News

---

How Can OPSWAT Help

Two of this week’s stories are squarely file- and package-borne. The joyfill npm RAT ships as a malicious package that executes on import — the exact scenario MetaDefender’s multi-engine scanning and Content Disarm & Reconstruction (CDR) is built for: sanitize packages and artifacts before they reach developer machines or build pipelines. The Hugging Face agent breach shows AI agent toolchains pulling untrusted code and credentials; integrating file-level inspection (multi-scan + CDR) into model registries, artifact repositories, and agent tooling reduces the blast radius of trojanized packages and zero-day-laden artifacts.