Hook
Last week, Anthropic dropped a single paragraph into the crypto-narrative sewer: Claude Mythos, a reportedly specialized variant of their LLM, had “found a faster way to attack encryption algorithms.” No algorithm name. No attack complexity. No speed-up factor. Just a warm, fuzzy feeling for the AI bulls and a cold knot in the stomach of anyone who has ever audited a cryptographic primitive. This is the kind of announcement that should be met with a quiet “prove it” rather than a retweet. Math has no mercy, and a PR statement is not a cryptographic proof.
Context
The claim arrived without technical documentation, without a preprint on ePrint, and without a single named cryptographer willing to attach their reputation to it. Anthropic is the AI labs that markets itself as “safety-first,” a brand built on alignment research and red-teaming. Their Claude 3 and 3.5 models have demonstrated impressive reasoning on constrained tasks, but shifting from natural language to formal verification of cipher strength is an entirely different stack. The mythical “Mythos” moniker is not part of any public model list, suggesting either internal branding or journalistic over-excitement.
For context, the last time an AI was claimed to have cracked a central cryptographic problem was in 2023, when a team claimed GPT-4 could “break AES” by running a brute-force search in its token space – a claim that collapsed upon inspection because the LLM was simply repeating a textbook algorithm without any actual low-level execution. The difference between a model reciting a cryptanalytic method and executing it against a real cipher is the difference between a golf tutorial and a hole-in-one. t trust, verify the stack.
Core: Systematic Teardown
Let’s break down what the claim actually implies from a unit economics and systems perspective. Any new attack on a standardized symmetric cipher (AES, for example) or asymmetric scheme (RSA, ECDSA) would require either:
- A reduction in the time complexity of the best-known classical attack (e.g., from 2^128 to 2^96 for AES-128), or
- A practical side-channel or fault attack that exploits implementation weaknesses, or
- A quantum-mechanical speedup beyond what Grover’s algorithm provides.
Anthropic offered none of these numbers. The absence of a specific target suggests the attack, if real, is not on a well-studied primitive but on an obscure or proprietary construction – or worse, on a misapplication of a primitive. In my 2018 audit of Bancor v1, I found an integer overflow that on paper looked like a vulnerability but in practice required impossible preconditions. Many “AI-discovered weaknesses” follow the same pattern: the model flags a theoretical edge case that the cryptographers already knew and sealed.
Furthermore, the cost of running a state-of-the-art cryptanalysis search using an LLM is non-trivial. Even if Claude Mythos is fine-tuned for symbolic reasoning and integrated with a SAT solver or a lattice-reduction library, the inference cost per query would dwarf standard RAG or chain-of-thought operations. Based on my work modeling yield curves for DeFi protocols, I’ve learned that unsustainable narratives often hide behind asterisks of “unpublished results.” If this capability existed and was economically viable, Anthropic would have already monetized it through a security audit API.
High yield, high graveyard. A claim without data is a liability, not an asset.
Contrarian Angle: What the Bulls Might Get Right
To be fair, the contrarian angle deserves a hearing. Anthropic is not a random parachute project. They have a track record of careful disclosure – they responsibly reported the “many-shot jailbreak” vulnerability before releasing a fix. If Claude Mythos has found a genuine subtle flaw in a widely-deployed protocol, the decision to stay vague may be due to ongoing coordination with NIST, CISA, or the affected library maintainers. Delaying publication of the attack details is standard responsible disclosure, not deception.
Moreover, the intersection of large language models and formal methods is a genuine research frontier. Tools like Lean, Coq, and SMT-solvers have been used to verify cryptographic implementations, but they require human experts to guide them. If Anthropic has combined Claude’s natural language understanding with a symbolic engine, they could have automated the discovery of side channels in implementations like OpenSSL’s constant-time operations. That would be a real innovation, even if it does not constitute a theoretical breakthrough in the mathematical hardness of AES. In my 2022 post-mortem of Terra/Luna, I saw how a fragile mechanism (the death spiral) could be predicted by a model that understood both economics and code. Similarly, an LLM that reads cryptographic source code could flag algorithmic time variability that a human auditor might miss.
Still, until the attack vector is disclosed and peer-reviewed, the safe bet is that this is an incremental step, not an epochal shift. The smart money waits for replication.
Takeaway: An Accountability Call
The crypto world is drowning in claims that collapse under rigorous modeling. Anthropic’s Claude Mythos declaration will either vanish into the graveyard of unverified AI breakthroughs or become the first case where an LLM outperformed human cryptanalysts. The cryptographic community needs to demand a preprint, a proof-of-concept implementation, or a CVE. Until then, treat this as a marketing signal, not a technical invariant. It is the staccato rhythm of hype that eats real innovation. Verify the stack, or accept the loss.