Claude Mythos Finds Crypto Flaw in 60 Hours

Bottom line: I’d read this as a story about cost, focus, and human review - not as proof that AI can break modern crypto on its own.

In 60 hours and with $100,000 in spend, Claude Mythos helped find a nonce-generation flaw tied to HAWK. The issue could let an attacker use public signatures to work toward private-key recovery with a lattice attack. At the same time, the article is careful on one point: round-reduced AES is not full AES.

If I had to sum up the article in a few lines, it’s this:

• Target: HAWK and round-reduced AES
• Result: a confirmed nonce-bias issue in HAWK
• Risk: enough weak nonces can turn public signatures into a path to key theft
• Cost: $100,000 over one weekend-style push
• Process: AI generated leads; humans filtered and checked them
• Lesson: start cheap, verify early, and use top-tier models late in the workflow

What stands out to me is the split between search and proof. The model appears to have helped sift through code and attack ideas fast, with an 83.1% first-try exploit reproduction rate cited in the piece. But the article’s own message is clear: people still had to confirm what was real.

For developers and security teams, the article’s advice is plain:

• use smaller models first
• set hard budget caps
• validate before you scale up spend
• treat model output as leads, not final findings

That’s the part I’d keep. The main takeaway isn’t that AI found something new. It’s that a tightly scoped, human-checked workflow can turn a known attack pattern into a tested finding - if you’re willing to spend the time and money.

How AI Finds Vulnerabilities in Cryptographic Libraries

2. How Claude Mythos Spent the Time and Money

The 60-Hour Investigation Timeline

The 60-hour sprint moved in a clear sequence: attack framing, model-guided analysis, refinement, and verification against HAWK and reduced-round AES. At the start, the team picked specific attack goals and defined what would count as a confirmed finding. Then Claude Mythos shifted into repeated variant hunting, matching known vulnerability patterns to possible flaws in cryptographic code without using standard SAST tools ^[4].

The middle stretch focused on testing candidate weaknesses and cutting false positives. Human reviewers handled that filtering step. Claude Mythos reproduced exploits on the first try 83.1% of the time, which meant fewer dead ends and less wasted effort ^[1].

In the last phase, the team checked the strongest candidates against source code and the cryptographic assumptions behind each target. Those checks set up the attack scenarios described next.

Where the $100,000 Went

The $100,000 covered repeated model runs, workflow orchestration, and human review. Put simply, the money didn't go to one big shot. It went to running the loop again and again until weak leads dropped out and the strong ones held up.

Smaller open-weights models can also help on the verification side. In some cases, they can recover complex exploit chains for as little as $0.11 per million tokens ^[3].

How APIMart Fits Into Multi-Model Security Workflows

APIMart can route hypothesis generation, analysis, and verification through one OpenAI-compatible endpoint. That made it easier to move from candidate discovery to verification without stitching together a messy handoff between tools.

3. The Flaw in Practice: What Attackers Could Do

Attack Scenarios the Discovery Makes Possible

The strongest lead was a nonce-generation flaw that turned public signatures into a path for private-key recovery. Claude Mythos found biased nonce generation in the target implementation. When nonces aren't uniform, an attacker can collect signatures over time and run lattice-based Hidden Number Problem (HNP) attacks to recover the private key ^[5].

The easiest targets are systems that expose lots of signatures in public. An out-of-range nonce rate of about 6% can be enough to spot weak nonce generation and justify a key-recovery attempt using public signatures ^[5]. Once an attacker has the private key, they can forge signatures and impersonate the key owner ^[5]. That's what makes this practical. The public signatures themselves become the raw material for the attack.

Measured Impact Compared to Prior Attack Baselines

The main shift here is operational. The model turned a known attack class into a working path faster than manual triage alone. That speed matters because Claude Mythos reproduced exploits on the first try 83.1% of the time ^[1].

4. What This Means for Developers, Security Teams, and AI Operations

Where AI Helps Most in Cryptographic Research

AI didn't invent a new attack class here. What it did was speed up the grind: finding likely candidates, checking hypotheses, and pushing known attack patterns across a security-heavy codebase.

That difference matters in practice. AI can cut down the search space, but it can't decide what counts as a real issue. People still have to read the code, test the claim, and check it against the crypto design.

In July 2026, zkSecurity's AI audit agent, zkao, confirmed seven real bugs in Cloudflare's CIRCL experimental cryptography library, including a critical float64 precision loss in threshold RSA and an access-control break in attribute-based encryption - all subsequently fixed upstream ^[2]. That's the split in plain terms: AI helps teams find more things to inspect, and human reviewers decide which ones hold up.

How to Plan a Similar Audit Without Wasting Budget

A good audit flow is pretty simple:

• Start with cheaper models to find the right code paths and flag obvious candidates
• Check those findings against the source code and the crypto assumptions
• Move to a flagship model only after a candidate survives that review
• Set budget caps before the work starts
• Add an early validation checkpoint so the team can continue, pivot, or stop before burning money on a dead end

That order matters. A 3.6 billion parameter open-weights model can detect complex exploits for as little as $0.11 per million tokens ^[3]. So the pricey compute should come at the end of the pipeline, not the start.

This is what makes AI useful in cryptographic audits. It's not just about going faster. The main lesson from the Mythos sprint is the tradeoff between speed, verification, and cost: the $100,000 and 60 hours produced a confirmed, human-verified finding because the process matched the level of rigor the target required.

5. Conclusion: The Cost and Security Value of AI-Assisted Cryptanalysis

Mythos confirmed a nonce-generation flaw in HAWK by using LLM subagents to scan files in parallel and inspect the source code directly. Human verification is what made the result believable. The AI work cut down the search time and surfaced a candidate issue that reviewers could then confirm and measure ^[4]. That shifts the focus. The main question isn’t novelty so much as cost.

The next issue is efficiency: what did that search actually cost? At this scale, budget pressure is hard to ignore, and the answer depends a lot on scope. A sensible setup is to use smaller open-weight models for the first pass, then save flagship models for the parts that need deeper reasoning ^[3].

For teams, the takeaway is practical, not abstract. Keep the scope tight, validate early, and treat AI output as leads rather than final answers. As Curl’s Daniel Stenberg put it plainly:

AI supports human review, not replaces it

That point shows up clearly in one Curl audit. Mythos flagged five issues, but manual review narrowed that list to one low-severity CVE and one bug ^[4].

FAQs

Could this flaw expose a private key in real systems?

Yes. If someone exploits a flaw that gives kernel-level access, they can take over the entire system. That can expose sensitive data, including private keys stored on those machines.

The research shows that AI-assisted analysis can find and chain complex vulnerabilities. In plain English, that means attackers may have an easier time linking small flaws together into a much bigger breach, which increases the risk of attacks at scale.

Why did the audit cost about $100,000?

The roughly $100,000 price tag came from the heavy use of specialized compute, advanced tooling, and testing infrastructure needed to run deep security analysis over 60 hours.

It also covered the technical work needed to identify, verify, and document critical flaws in complex, high-stakes cryptographic systems.

What did humans verify that the AI could not?

People checked the AI’s findings by reading the source code themselves and reviewing each case by hand to catch mistakes.

They found that many issues the AI had “confirmed” were actually false positives or plain bugs, not security flaws. That extra review helped make sure high-severity findings were accurate before anyone treated them as valid.