A research disclosure published in late July 2026 has generated significant attention across the cybersecurity community, and for good reason. Anthropic announced that its most advanced AI model conducted two meaningful cryptographic research results: a complete key-recovery attack against a post-quantum signature scheme called HAWK-256, and a 200 to 800 times speedup of an existing attack on seven-round AES-128.
The headlines are striking. The practical implications for most businesses are more nuanced. But the broader story behind these findings, what they reveal about where AI-assisted cryptanalysis is heading and what it means for the encryption standards your business relies on, is worth understanding clearly rather than either dismissing or overstating.
Here is what happened, what it actually means, and what small and mid-sized businesses should be thinking about in response.
What Anthropic’s AI Actually Did
Anthropic reported that its Claude Mythos Preview model helped derive an end-to-end key-recovery attack against HAWK-256 and a 200 to 800 times speedup for an attack on seven-round AES-128.
HAWK is a lattice-based digital signature scheme currently under evaluation by the National Institute of Standards and Technology as part of its post-quantum cryptography standardization process. Post-quantum cryptography refers to encryption algorithms designed to resist attacks from quantum computers, which would theoretically be capable of breaking many of the encryption standards currently in widespread use. HAWK is the only lattice-based scheme among the nine candidates that NIST advanced to the third round of its additional post-quantum digital-signature process in May 2026.
The HAWK-256 parameter set that Anthropic’s AI attacked is not one of the security-level parameter sets that NIST is evaluating for production use. HAWK-256 is a challenge parameter provided as a cryptanalytic target, essentially a smaller version of the scheme that researchers are invited to attack precisely because it is expected to be weaker. Anthropic said neither result affects production systems.
On the AES side, the result targets a reduced version of AES-128 running only seven of its ten rounds. Studying reduced-round versions of encryption algorithms is standard cryptanalytic research practice. The attack assumes an adversary can obtain about 2^105 chosen plaintexts encrypted under one fixed, unknown key. That requirement alone puts it far outside real-world use.
So to be precise about what happened: an AI model produced legitimate, novel cryptographic research results that advance the state of knowledge in the field, in roughly 60 hours for HAWK and three days for AES, at a cost of approximately $100,000 in API usage for each. Neither result breaks any encryption currently protecting your business data. Both results are meaningful contributions to the research community’s understanding of where current and candidate encryption schemes carry margin for improvement.
Why This Still Matters for Business Security
The fact that neither finding affects production systems today does not mean the story ends there. There are two reasons this disclosure matters for how businesses think about their security posture, even if no immediate action is required.
The first is the demonstration of AI’s capability as a cryptanalysis tool. Anthropic said Mythos Preview largely conducted the research itself, with humans supplying project direction, computing resources, and extensive verification. The human researchers involved were not lattice cryptography specialists. The AI model did the technical work, and it did it in a timeframe and at a cost that would have been difficult to achieve through traditional research methods. Anthropic said two researchers took nearly a month to reach confidence that the AES result was correct, and on Anthropic’s account, verification was the visible bottleneck.
That dynamic, where AI can generate sophisticated cryptographic research faster than human experts can verify it, will not stay contained to well-resourced AI safety companies publishing responsibly. The same capability that produced these research results will become available to a broader range of actors over time, including ones whose intentions are less transparent. The timeline for AI-assisted discovery of cryptographic weaknesses in production systems has gotten shorter, even if today’s results do not yet cross that line. How AI is transforming cybersecurity covers the broader shift in both offensive and defensive capability that this disclosure is one data point within.
The second reason is the post-quantum transition timeline. Businesses that handle sensitive data, operate under regulatory frameworks, or have long data retention requirements need to be actively thinking about post-quantum cryptography now, not when a production-affecting result forces the conversation. NIST continued to list HAWK as a third-round candidate as of July 29, 2026, and the standardization process is progressing. But the research community’s ability to probe candidate schemes has accelerated materially, and the organizations that are prepared when standards finalize will be in a significantly stronger position than those scrambling to catch up.
What Post-Quantum Cryptography Means for SMBs
Most small and mid-sized businesses have not started thinking about post-quantum cryptography, and most do not need to make immediate changes to their encryption infrastructure today. The encryption standards currently protecting business data, including AES-128 and AES-256 for data at rest, and TLS for data in transit, remain secure against known attacks including the seven-round AES result disclosed by Anthropic.
But the concept of crypto agility, the ability to update cryptographic algorithms as standards evolve without a full infrastructure overhaul, is worth building into technology planning now. Businesses that have made deliberate choices about their encryption standards, understand what algorithms are in use across their environment, and have relationships with technology partners who are tracking the post-quantum transition will be able to adapt as NIST finalizes its post-quantum standards without the disruption and cost of emergency remediation.
For businesses in regulated industries, the timeline is more pressing. Healthcare organizations, financial services firms, defense contractors, and others operating under compliance frameworks that specify cryptographic requirements should be tracking NIST’s post-quantum standardization process and beginning conversations with their IT and security partners about what a transition roadmap looks like for their specific environment. The guide to cybersecurity compliance standards covers the major regulatory frameworks that are likely to issue updated cryptographic requirements as post-quantum standards finalize.
The Broader Lesson: AI Is Reshaping the Security Research Landscape
Beyond the specific technical findings, this disclosure illustrates something that every business owner and IT decision-maker should be integrating into their thinking about security: the pace at which AI is changing both the offensive and defensive sides of cybersecurity is accelerating.
On the offensive side, AI is enabling faster discovery of vulnerabilities, more sophisticated social engineering at scale, and the kind of technical research that previously required specialized expertise and significant time investment. The democratization of that capability creates pressure on the cryptographic and security infrastructure that businesses rely on.
On the defensive side, AI is enabling faster threat detection, more comprehensive monitoring, and security analysis at a scale that human teams alone cannot achieve. The organizations that are working with security partners who are actively integrating AI into their defensive capabilities are building an advantage over those that are not. Managed security services with AI-enhanced threat detection and continuous monitoring provide the defensive layer that keeps pace with a threat environment that is evolving faster than human teams alone can track.
For small and mid-sized businesses, the practical implication is not to panic about post-quantum cryptography or to make immediate infrastructure changes in response to this disclosure. It is to ensure that your security program is being managed by people who are tracking these developments, incorporating them into their risk assessments, and advising you proactively about what they mean for your specific environment. A managed security partner who is not paying attention to the research community’s advances in AI-assisted cryptanalysis is a partner who will be reactive when the threat landscape shifts rather than prepared.
What to Do Now
For most SMBs, the right near-term response to this disclosure is awareness rather than immediate action. The encryption standards protecting your data today remain sound. The research results Anthropic published are legitimate scientific advances, not a signal to change your passwords or rebuild your infrastructure.
What is worth doing now is beginning a conversation with your IT and security partner about your organization’s cryptographic posture: what encryption standards are in use across your environment, where your sensitive data lives and how it is protected, what your current TLS configuration looks like, and whether your organization has a plan for transitioning to post-quantum standards as NIST finalizes them. A structured IT risk assessment that includes a review of encryption standards and data protection controls gives businesses the accurate baseline that informed planning requires.
For businesses in regulated industries, that conversation should also include whether your compliance framework has issued guidance on post-quantum cryptography and what your obligations are likely to look like as standards evolve.
And for any business that is not currently working with a managed IT and security partner who is tracking developments like this one and advising you proactively about what they mean, this is a reasonable moment to ask whether your current arrangement is providing that level of strategic guidance or simply keeping the lights on.
At Mindcore Technologies, we track developments across the cybersecurity research landscape and build that awareness into the guidance we provide to the small and mid-sized businesses we serve. The encryption standards protecting your data today are sound. The threat landscape is not static, and the businesses that navigate it successfully are the ones that are paying attention before they have to.
Meet Our CEO, Matt Rosenthal
Matt Rosenthal is the President and CEO of Mindcore Technologies. With extensive experience in cybersecurity strategy and managed IT services for small and mid-sized businesses, Matt leads a team that helps SMBs understand and respond to a threat landscape that is evolving faster than ever. He works directly with business owners and IT leaders to translate complex security research and developments into practical, business-aligned guidance.
Frequently Asked Questions
Did AI just break the encryption protecting my business data?
No. The cryptographic results Anthropic published in July 2026 do not affect the encryption standards currently protecting business data. The HAWK-256 attack targets a challenge parameter set that is not used in production systems, and the AES result applies to a reduced seven-round version of AES-128 that requires an impractical number of chosen plaintexts to execute. Both results are legitimate scientific advances but neither requires immediate changes to your security infrastructure.
What is post-quantum cryptography and why should SMBs care?
Post-quantum cryptography refers to encryption algorithms designed to resist attacks from quantum computers, which could theoretically break many encryption standards currently in widespread use. NIST is in the process of standardizing post-quantum algorithms, and businesses that understand the transition timeline and begin planning now will be in a stronger position than those who wait for the change to be forced on them. Regulated industries and businesses with long data retention requirements have the most pressing timelines.
What is crypto agility and why does it matter for my business?
Crypto agility is the ability to update cryptographic algorithms as standards evolve without a full infrastructure overhaul. Building crypto agility into your technology architecture means understanding what encryption standards are in use across your environment and working with technology partners who can help you transition efficiently as NIST finalizes its post-quantum standards. It is a planning discipline rather than an immediate technical requirement for most SMBs.
How is AI changing the cybersecurity threat landscape for businesses?
AI is accelerating both offensive and defensive cybersecurity capabilities. On the offensive side, it enables faster discovery of vulnerabilities, more sophisticated phishing and social engineering, and technical research that previously required specialized expertise. On the defensive side, it enables faster threat detection, more comprehensive monitoring, and security analysis at a scale that human teams cannot achieve alone. Businesses working with security partners who are actively integrating AI into their defensive capabilities are building a meaningful advantage.
What should I ask my IT provider about our current encryption posture?
The key questions are: what encryption standards are in use across our environment, how is our sensitive data protected at rest and in transit, what does our TLS configuration look like, and do we have a roadmap for transitioning to post-quantum standards as NIST finalizes them? If your provider cannot answer those questions with specificity, that is a gap worth addressing.
How do I know if my security partner is tracking developments like this one?
Ask directly. A security partner who is tracking the research landscape should be able to speak to recent developments, explain their relevance to your specific environment, and advise you proactively rather than waiting for you to raise the question. If your current provider is not having those conversations with you, schedule a consultation with our team to discuss what a more proactive security partnership looks like.
AI Cryptanalysis Research and Post-Quantum Cybersecurity Strategy Expertise from Matt Rosenthal
Matt Rosenthal, CEO of Mindcore Technologies, has over 30 years of experience helping small and mid-sized businesses translate complex cybersecurity research developments into practical, business-aligned guidance rather than either dismissing them as irrelevant or overstating their immediate operational impact. He has seen firsthand how businesses rely on managed IT partners who are not tracking the research community’s advances, then find themselves reactive when the threat landscape shifts in ways a more attentive partner would have flagged months earlier. Matt leads a team that monitors developments across the cybersecurity research landscape, including the post-quantum cryptography standardization process and the accelerating role of AI in both offensive and defensive security research, advises clients on their current cryptographic posture including what encryption standards are in use across their environment and what a transition roadmap toward post-quantum standards looks like for their specific compliance obligations, and provides the strategic guidance that ensures businesses in regulated industries are tracking NIST’s post-quantum process before a standard change forces an expensive emergency response.
