WASHINGTON: A leading artificial intelligence (AI) model built by Anthropic has found flaws in a weakened version of a digital encryption standard that is in pervasive use throughout the internet, the company’s researchers said on July 28, underscoring the potential risks to global cybersecurity posed by ever-improving AI software.
During a research-led test, the model, Claude Mythos Preview, was able to detect new ways to attack cryptographic algorithms that keep everything from online bank transactions to private communications to state secrets safe from the prying eyes of hackers or other unwanted third parties.
The research shows that AI could one day challenge core assumptions for how the Internet operates. While experts say AI is likely to upend many industries, AI systems have made particularly rapid advancements in coding and cybersecurity.
The flaws identified do not concern a cryptographic standard currently in use today, which means that modern banking and communication systems are not subject to immediate potential intrusions from AI. Instead, Anthropic’s technology cracked a watered-down version of an algorithm for Advanced Encryption Standard, or AES, a ubiquitous protocol that safeguards web traffic, wireless networks, data storage and more.
It is common to perform tests on weaker versions of encryption algorithms to understand whether more powerful computers could someday crack the actual standards, akin to solving a simpler math problem to identify whether patterns may exist for a more complicated one. In the testing, Mythos was able to break the weaker version of AES in a way that Anthropic said made an assault 200 to 1,000 times faster than what previous human research had managed to do.
While the immediate ramifications are minimal, the long-term implications could be significant. In previous tests, large-language models seemingly could not match or best what humans can do in the mathematically dense field of cryptographic research, but their rapid advances could suggest a future in which top models can surmount traditional Internet security protections that are foundational to just about everything that takes place on the Internet.
The latest releases of frontier AI models have in recent months spooked governments worldwide, including the Trump administration, with their powerful capabilities, particularly in the field of cybersecurity.
When Mythos first made its debut in April, it was so adept at finding and exploiting computer bugs that Anthropic limited its release to select government agencies and organisations to prevent the possibility of a global digital catastrophe. The Trump administration, which initially once took a hands-off approach to AI regulation, has veered toward an ad hoc system of oversight. Many American AI companies are now submitting models for review by the government before releasing them publicly, and Mythos remains unavailable to the general public.
Last week, concerns about the powers of leading AI systems peaked again. OpenAI acknowledged its models had leapt out of a safe testing environment, known as a sandbox, that is designed to be unconnected to the Internet and successfully hacked into an AI technology digital library in an effort to essentially steal the answers to an exam that was grading their abilities.
US and Western intelligence officials have warned for decades that if existing encryption standards were ever broken, it would have profound consequences for digital privacy and national security. China is believed to have collected vast troves of encrypted data, for example, potentially in hopes that it may be able to someday decode the information. The race between the United States and China to build advanced quantum computers that could one day break modern encryption protocols has only heightened concerns around existing standards.
In addition to the attack on the encryption standard, Mythos also orchestrated another improved attack against a different digital cryptographic system known as Hawk that is designed to be bulletproof against traditional and quantum computers. Hawk is not currently in use but under consideration by the National Institute of Standards and Technology to become a new standard. The Hawk attack was validated by its authors, and independent cryptographers reviewed the AES attack, Anthropic said, adding that it had shared its findings with the US government and industry partners before publication.
Mythos devised the cryptographic attack on AES almost entirely autonomously, Anthropic said, but only after first refusing to contemplate the problem because it believed it was impossible to improve on existing methods of analysis. But after some coaxing, the chatbot sat with the puzzle for about a week before engineering its novel attack. Two human researchers then worked for nearly a month to verify that the method appeared correct.
Encryption is foundational to virtually everything that takes place on the Internet, and some of the techniques in use today have protected the world’s secrets since the 1970s. Quantum cryptography, which builds on the complicated properties of quantum physics, is a form of encryption that is in theory unbreakable.
AES was adopted as a government standard in 2001 and was widely seen as nearly unbreakable at the time. Conventional methods of brute-force code cracking, in which a computer uses trial and error to guess combinations of a password or encryption key, are generally seen as incapable of defeating AES. The standard is believed to have nearly as many key combinations as there are atoms in the observable universe.
But advances in AI on some fronts have outpaced what many evangelists assumed was possible even a few years ago. The recent advances have fuelled concerns that the mathematical core of Internet security standards could one day be vulnerable regardless of advances in quantum computing. – ©2026 The New York Times Company
This article originally appeared in The New York Times.
