Claude and Microsoft’s AI Security Claims, Checked

On 27 and 28 July 2026, Microsoft and Anthropic each put out a security announcement, one day apart. That back-to-back timing is what makes this AI cryptanalysis and vulnerability-hunting story worth checking twice: Microsoft said its new MAI-Cyber-1-Flash model, built into a defensive tool called MDASH, scored 96% on a hacking benchmark. Anthropic said an internal research version of Claude, nicknamed Mythos, had found a genuinely new attack on a post-quantum signature candidate and sped up an attack on a reduced version of AES. Press coverage ran with the boldest possible reading of both. The two companies’ own technical write-ups, read closely, say something narrower, and more interesting, than either headline.

Two headlines, 24 hours apart

Start with what each company actually said, in its own words, before any outside coverage touched it. It is the same read-the-source habit that matters for any defensive architecture claim, including the zero trust principles vendors like to attach to a benchmark number.

Anthropic’s post was a research disclosure, not a product launch. Claude Mythos Preview is described as a research and partner-access model, not something available commercially, and Anthropic used it to attack two cryptographic targets: HAWK-256, a signature scheme competing to become a future US government post-quantum signature standard, and a weakened, 7-round version of AES, the encryption algorithm that protects most of the internet’s traffic today. Both results came out of long, semi-autonomous runs where the model worked for hours or days with only light human steering.

Microsoft’s post, by Mustafa Suleyman and Hayete Gallot on microsoft.ai, was a product announcement. MAI-Cyber-1-Flash is a compact model built specifically for security work, folded into MDASH, a multi-agent system Microsoft sells to enterprise security teams for finding and fixing vulnerabilities in their own systems. Microsoft’s framing throughout is defensive: this is a tool for the people protecting a network, not a tool for attacking one.

Those are two different kinds of claim, aimed at two different audiences, and neither company was talking to the other. What links them is timing, and what they share once you strip the marketing language is a pattern worth applying to both: check what the source document actually says, not what the headline implies it says.

Claude and HAWK-256: what the 2^38 number really means

Anthropic’s headline number is a drop from 2^64 to 2^38 in the operations needed to break HAWK-256. Those are exponents of 2, the way cryptographers measure how many guesses an attacker has to try. That drop is a genuine improvement, roughly a factor of 64 billion fewer guesses needed, and Anthropic’s own post calls it, in its words, “effectively cutting its key strength in half.”

That is where the coverage got ahead of the source. The Hacker News and other outlets ran headlines describing this as Claude cracking post-quantum encryption. Anthropic’s own text says something narrower: this is “a faster exponential time attack… than previously known,” not a shortcut that makes the problem easy. 2^38 operations is still an enormous number, well beyond what any attacker can run against a real, correctly-sized key today. Anthropic’s own conclusion states it plainly: “for larger keys, HAWK therefore remains impractical to attack.”

There’s a second detail worth sitting with: HAWK-256 is not a deployed standard. It’s one of several candidates competing to become a future US government post-quantum signature standard, part of a multi-year evaluation process precisely designed to catch weaknesses like this one before anything ships. Finding a better attack on a candidate during that process is the system working as intended, not a security failure. Nothing that currently protects a bank, a government system, or a website used HAWK-256 to begin with.

Anthropic — Discovering cryptographic weaknesses with Claude — the research post behind the HAWK-256 and AES results.

What’s genuinely notable, and gets lost under the “cracked” framing, is how the result was produced. Anthropic reports the work took roughly 60 hours of semi-autonomous effort with occasional human guidance, at a reported API cost of around $100,000. That’s a real research campaign, not a one-shot prompt, and it’s a data point about what frontier AI models can now do inside a cryptography research workflow: sustain a long, technical investigation over days, correct course with light supervision, and land on a mathematically valid improvement. The headline exaggerates the outcome. The process behind it is the actual news.

The AES result: a real technique, and a price tag that keeps it theoretical

The second Anthropic result got less press attention but is arguably the more interesting one technically. A new technique the researchers nicknamed “Möbius Bridge” sped up an existing attack against AES by somewhere between 200 and 800 times, depending on how the speedup is measured.

That multiplier sounds dramatic until you read the fine print Anthropic put in its own post: “our attack is on a reduced version of AES and does not break the full cipher.” Standard AES runs 10 to 14 rounds of scrambling depending on key size. This work targets a 7-round version, an intentionally weakened variant cryptographers use as a testbed, precisely because the full cipher is considered out of reach of any known attack. A 7-round break says something about the technique. It says nothing about whether a password manager, a bank’s encrypted connection, or an encrypted backup is at risk, because none of them run a 7-round cipher.

Anthropic’s own cost estimate closes the gap even further: even with the 200 to 800x speedup, the attack “would cost hundreds of millions of dollars to implement.” That places it firmly outside what any realistic attacker, short of a well-funded state actor with a reason to spend that kind of money breaking a 7-round toy cipher, would ever bother running.

What makes this result worth reading past the multiplier is the second half of Anthropic’s own account: development was near-autonomous, driven by three prompts over three days (Anthropic’s own account calls them “substantive,” despite there being only three), generating up to a billion tokens of output. But it then took nearly a month for two human researchers to confirm the result was mathematically correct. The bottleneck in this kind of work didn’t disappear with AI involved. It moved. A model can generate a candidate proof or attack at a pace no team of humans could match; checking that the proof holds up is still slow, specialist, human work. Anthropic’s own framing line for both results is the one worth keeping: “neither of these results has a practical impact on today’s computer systems.”

Microsoft’s 96% belongs to three models, not one

Microsoft’s MDASH announcement leans on a single number: 96% on CyberGym, a benchmark that measures how well an AI system can find and validate real vulnerabilities in code, described as 12 points ahead of Claude Mythos and ahead of Google’s and OpenAI’s comparable models.

Read on its own, that sentence implies MAI-Cyber-1-Flash, the compact model Microsoft built and named, is the best vulnerability-hunting model in the industry. Microsoft’s own post says something narrower (also reported by next.ink): the 96% score belongs to the full MDASH system, not to MAI-Cyber-1-Flash working alone. Inside that system, the compact model handles roughly 90% of the workload, the routine cases. The hardest 10% of the vulnerabilities, the share that likely accounts for most of the benchmark’s difficulty, get routed to GPT-5.4, a separate, larger model from a competing vendor, folded into Microsoft’s own product. The headline number is a team score. The model in the product’s name did most of the volume, not all of the hardest work.

Microsoft AI — Introducing MAI-Cyber-1-Flash inside MDASH — the product announcement behind the 96% CyberGym score.

There’s a further caveat that applies regardless of which model gets credit: CyberGym is Microsoft’s own benchmark run, in a Microsoft-controlled environment, with no independent third party cited as having verified the number. That doesn’t make the result false. It means the same rule that applies to Anthropic’s cryptography claims applies here: a self-reported score from the company that built the product is a starting point for scrutiny, not a finish line.

Microsoft’s own economic argument is worth taking at face value, because it’s a plainer and more checkable claim than the benchmark score: the new MDASH setup costs roughly half as much to run as the previous configuration, which relied more heavily on GPT-5.4 for everyday tasks and used the specialized model for only a smaller share of the work. Microsoft also points to a structural advantage that’s genuinely hard for any competitor to replicate quickly: its access to what the company describes as 100 trillion daily security signals collected across its cloud, endpoint, and identity products. That’s a defensible reason a Microsoft-specific model might get real advantages on real enterprise traffic, independent of whatever a single leaderboard number claims.

Why a self-reported score deserves the same skepticism on both sides

Line up the two announcements and a pattern repeats: a strong number gets attached to a name, and the name attracts more credit than the underlying result supports. Anthropic’s own post never claims Claude “cracked” anything; the press headline did that work. Microsoft’s own post never explicitly says the 96% score belongs to MAI-Cyber-1-Flash alone; the framing of “our new model scores 96%” invites the reader to make that leap unassisted.

Neither company misrepresented its own data. Both wrote technically careful primary documents that, read in full, include the caveats: HAWK-256 “remains impractical to attack,” the AES work “does not break the full cipher,” and, per next.ink, the CyberGym score reflects a two-model system (MAI-Cyber-1-Flash and GPT-5.4, orchestrated by MDASH), not a single one. The gap opens between the careful primary text and the number that gets extracted from it for a headline, a slide, or a social post. That gap is not unique to Anthropic or Microsoft. It’s the standard failure mode of any vendor-reported security benchmark, from antivirus detection rates to breach-response time claims, and the fix is the same regardless of vendor: read past the number to the paragraph explaining how it was produced and what it doesn’t cover.

Readers who want a fuller framework for weighing this kind of AI security claim against an actual standard, rather than a vendor’s own scorecard, can look at how OWASP, MITRE ATLAS, and the NIST AI Risk Management Framework each try to formalize what counts as verified for AI-related security work, since none of them let a vendor grade its own homework.

What’s actually new here

Strip away the inflated headlines from both announcements and what’s left is still a real shift, just a quieter one than either company’s marketing implied. Frontier AI models are now doing genuine, sustained work in two directions that used to be almost entirely separate fields: attacking cryptographic schemes to find their weak points, and defending production systems by hunting for vulnerabilities before an attacker does. Neither Claude Mythos nor MAI-Cyber-1-Flash broke anything a reader needs to worry about this week. Both did real technical work that took days of semi-autonomous effort and, in Anthropic’s case, weeks of human verification afterward, work that would have taken a specialized human team considerably longer to even attempt.

That’s the durable part of this story, and it will still be true next year regardless of which specific model version is current by then: AI is becoming a working instrument in security research on both the offensive and defensive side, at the same time, from competing labs. The gap between a careful primary source and its own headline is not going away either. The next vendor with a big security number to announce will face the exact same question a careful reader should ask of this one: what does the company’s own technical document say, once the adjective in the headline is stripped back out?

FAQ

Did Claude actually break post-quantum encryption?

Claude did not break post-quantum encryption. Anthropic’s own research post describes an improved attack on HAWK-256, a candidate post-quantum signature scheme still under evaluation, that cuts the theoretical break cost from 2^64 to 2^38 operations. That number is still far beyond what’s practically reachable, and Anthropic’s own text says HAWK “remains impractical to attack” for real-world key sizes. Headlines describing it as “cracked” belong to press coverage, not to Anthropic’s own claim.

Is the AES encryption used online now weaker because of this research?

The AES encryption used online today is not weaker because of this research. The Anthropic technique nicknamed Möbius Bridge was demonstrated against a deliberately weakened, 7-round version of AES, used by cryptographers as a research testbed, not the full 10-to-14-round cipher that protects real traffic. Anthropic’s own post states the attack “does not break the full cipher” and would cost hundreds of millions of dollars to run even against the reduced version.

Does MAI-Cyber-1-Flash really score 96% on security benchmarks?

MAI-Cyber-1-Flash alone does not score 96%; that figure belongs to Microsoft’s full MDASH system, according to next.ink’s reporting on Microsoft’s announcement. Inside that system, MAI-Cyber-1-Flash handles roughly 90% of tasks, while the hardest 10% get routed to a separate, larger model, GPT-5.4. The benchmark itself is also self-reported by Microsoft with no cited independent verification.

Can businesses use these AI cryptanalysis and vulnerability tools today?

Businesses cannot use Anthropic’s cryptanalysis model today. Claude Mythos Preview is a research and partner-access model, not a commercial product. MAI-Cyber-1-Flash is deployed, but only inside Microsoft’s MDASH system for enterprise security customers doing defensive vulnerability detection and remediation, not as a standalone consumer or offensive tool.

Why does it take weeks to verify an AI-generated cryptography result?

Verifying an AI-generated cryptography result takes weeks because generating a candidate attack or proof and confirming it’s mathematically correct are different kinds of work. Anthropic reports its AES-related result was produced in three days of near-autonomous model output, but took nearly a month for two human researchers to verify. AI has sped up the generation step; the verification step still requires slow, specialized human review.

The takeaway

Neither Claude nor Microsoft’s security model did what its headline claimed, and both did something real anyway. Sustained, semi-autonomous technical work on cryptography and vulnerability research took days for the AI and, in Anthropic’s case, weeks for humans to check. The useful habit going forward isn’t distrust of AI security claims specifically. It’s reading the vendor’s own primary document, on either side of this industry, before the adjective in the headline does the deciding for you.