Cryptographers have spent years building defenses against quantum computers that don’t fully exist yet. Now they have a more immediate problem: an AI that does exist is already poking holes in their work. Anthropic’s Claude recently cracked a post-quantum test cryptographic scheme and independently discovered a faster attack against a seven-round variant of AES, according to The Hacker News. It is the kind of result that forces the security community to reckon with a threat model it wasn’t fully prepared for. For context on how Anthropic’s broader research agenda shapes these capabilities, our earlier coverage of Anthropic’s safety testing is worth revisiting.
The findings are not theoretical. Claude was reportedly given access to challenge problems drawn from real cryptographic research and returned working attacks, not just directional hints. The speed improvement on the seven-round AES attack is particularly notable because AES-128 uses ten rounds, and every incremental advance toward the full cipher narrows the margin that has kept the standard secure for decades.
What Claude Actually Did to AES
Advanced Encryption Standard has been the backbone of global data protection since NIST standardized it in 2001. Full AES is considered computationally unbreakable by classical means, but reduced-round versions are used as research benchmarks to probe structural weaknesses. A seven-round attack that executes faster than previously published methods is a meaningful step, not because it threatens production systems today, but because it reveals that AI can navigate the complex algebraic and differential reasoning that cryptanalysis demands — reasoning that previously required specialized human expertise built over years.
Claude’s approach reportedly combined differential cryptanalysis techniques with a kind of guided search that compressed the time typically needed to identify useful attack paths. The model did not just retrieve a known attack from training data; it appears to have constructed a novel, more efficient variant. That distinction matters enormously. Retrieval is a lookup problem. Construction is research.
The Post-Quantum Dimension Is the Bigger Alarm
The AES result is striking, but the post-quantum crack may carry longer-term consequences. NIST finalized its first set of post-quantum cryptographic standards in 2024, and governments and enterprises are in the middle of multi-year migration efforts. If AI-assisted cryptanalysis can stress-test those new schemes faster than human researchers anticipated, the migration timelines that organizations are currently planning around could turn out to be dangerously optimistic.
The post-quantum scheme Claude broke was a test construction rather than a finalized NIST standard, which limits immediate alarm. But the demonstration still signals that the window for quiet, unhurried migration may be shorter than the security industry assumed. AI models capable of novel cryptanalysis change the threat calculus for every organization betting its long-term data confidentiality on algorithms that haven’t been subjected to this kind of automated adversarial scrutiny. That concern connects directly to the broader pattern of AI systems surfacing unexpected attack surfaces, a dynamic we covered in depth in our report on Hugging Face exploit.
What Comes Next for Cryptographic Defense
The immediate response from the research community will likely focus on red-teaming: using models like Claude deliberately and systematically against candidate algorithms before they are standardized or widely deployed. That is arguably the correct use of this capability. An AI that can find weaknesses in a controlled research setting is far preferable to one that finds them after a scheme is embedded in critical infrastructure worldwide.
Anthropic has not announced a formal cryptanalysis research program, but results like these make the case for one. The harder institutional question is governance: who gets access to AI systems capable of novel cryptographic attacks, under what oversight conditions, and with what disclosure obligations when a real vulnerability surfaces. Those questions do not have answers yet, and the pace of capability development is not waiting for the policy conversation to catch up.
