An AI model found a symmetry in HAWK's lattice that halves its security margin, and the submission team pulled the scheme out of NIST's signature process the next day. No deployed system had to change.
On 28 July, Anthropic published a key-recovery attack against HAWK, a post-quantum digital signature scheme that had reached the third round of NIST's additional-signatures process. The next day the submission team pulled it. NIST's candidate page now records that "the submission team has withdrawn HAWK from the additional digital signatures standardization process".
The attack was produced by an AI model, Claude Mythos Preview, working semi-autonomously for roughly 60 hours with occasional human direction. Anthropic put the cost at about $100,000 in API usage and noted that the researcher supervising the work was not a lattice cryptography specialist. HAWK had been public since 2023 and had come through two rounds of expert review, advancing with eight other schemes to a third round in May 2026.
The model identified a previously unexploited symmetry, a nontrivial automorphism, in the lattice HAWK is built on. Using it roughly halves the block size required in lattice reduction to recover an equivalent secret key. In the figures posted to NIST's pqc-forum, key recovery for HAWK-512 drops from 2^150 to 2^108 operations, and for HAWK-1024 from 2^288 to 2^182. For the smallest parameter set, HAWK-256, it falls from 2^64 to 2^38, and Anthropic released a working implementation with an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server.
Nobody is recovering a HAWK-512 key at 2^108. The attack is exponential and stays exponential; Anthropic is clear that this is a faster exponential attack rather than a practical break. What it removed was HAWK's competitive margin. The submission team verified the result and said the straightforward repairs, doubling the parameters or moving to higher-rank modules, would leave the scheme uncompetitive against the alternatives, so they withdrew it instead.
HAWK was a candidate, never a standard. The three post-quantum standards NIST finalised in August 2024, ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures, came out of an earlier process and are untouched by this result. Anthropic states plainly that the attack "is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general". The additional-signatures call HAWK entered exists to broaden the range of signature options; it opened with 40 submissions in 2023, and eight candidates remain.
Matthew Green's assessment is worth reading next to the paper. He treats the HAWK finding as genuinely important while pointing out that "none of the ingredients are exotic", meaning the work was a thorough application of existing lattice techniques rather than new mathematics. He is far more sceptical of the accompanying AES result, which he describes as a modest constant-factor improvement on work from 2013 and which needs on the order of 2^105 chosen plaintexts, a quantity of data that will never exist.
A public standardisation process is a mechanism for finding out that a scheme is weak while the cost of finding out is a mailing list post. It has done this before. Rainbow, a third-round finalist in the original competition, was broken by Ward Beullens in 2022 over a weekend on a laptop. SIKE, the isogeny-based candidate, was broken the same year by an attack that ran in about an hour on a single-core machine. Neither was standardised, and neither break cost anyone their data.
Disclosure here followed the same shape. Anthropic shared the attack with HAWK's authors in June, the authors confirmed it, and the public release was coordinated with the pqc-forum posting.
A scheme that fails in round three never held anybody's files.
For people protecting files rather than designing ciphers, the conclusions are narrow and worth stating flatly. Prefer finalised standards to candidates, because candidates are by definition still being attacked. Assume cryptanalysis gets faster from here, since a serious attempt now costs something closer to a week and six figures of compute than to a doctorate. And insist that whatever you use can change algorithms, because the practical value of a standardised primitive is partly that a weakness gets announced in public and a replacement already exists.
The same logic applies to files whose sensitivity outlasts the software holding them. Legal records, medical files, engineering archives and source documents stay valuable for decades, which is long enough for the cryptographic landscape underneath them to move more than once. That is the reasoning behind harvest now, decrypt later, and it is why the choice of key exchange matters for stored data and not only for live traffic.
Files in SpaceBox Lite are encrypted on the sender's device with AES-256-GCM, under a key exchanged using ML-KEM-768, the standardised FIPS 203 mechanism. The private key is generated on the recipient's device and stays there, so our servers hold ciphertext and nothing else, and a sender needs no account and hands over no personal data. Post-quantum key exchange is ordinary engineering practice across the industry now rather than a SpaceBox invention; what differs between products is custody, and that is the part worth checking. Lite is free (1 MB, one sender, three files, with a voucher at beta.i46.space adding 100 MB and 100 files), and it is not available to EU/EEA residents during the beta. Why SpaceBox sets out the rest.
HAWK's withdrawal cost no one any data, which is the difference between a scheme failing during review and a scheme failing in production. If you are handling files that need to stay private for a decade, the algorithm underneath them should already have been through this, and you should be able to replace it when the next result lands.