Claude Mythos and Cryptographic Vulnerabilities: What Changes

The result that surprised the cryptography community

On July 28, 2026, Anthropic announced an unexpected result. Its model Claude Mythos Preview identified vulnerabilities in key cryptographic algorithms. Among them, it found an improved attack on HAWK, a post-quantum signature scheme.

HAWK had been reviewed by human experts for over two years. No one had spotted that weakness. Claude Mythos found it in 60 hours, at an API cost of about $100,000.

According to The Decoder, Anthropic stated that the findings do not affect cryptographic systems currently in production. Still, the strategic implication is significant: AI can call the foundations of digital security into question.

What HAWK is and why it matters for post-quantum security

HAWK is a digital signature scheme designed to withstand attacks from quantum computers. It is part of the post-quantum standardization process launched by NIST in the United States. Its strength therefore has global implications.

Post-quantum cryptography is a fast-moving field. As quantum computers advance, classical algorithms such as RSA and ECC will become vulnerable. As a result, the international community has been working for years to define new standards.

The fact that an AI model found a weakness in HAWK in such a short time is a sign that human review alone may not be enough. Similarly, other post-quantum algorithms could contain flaws that have not yet been identified.

For more on the technical background, see the official documentation of the NIST Post-Quantum Cryptography Program.

How Claude Mythos tackled the problem

Claude Mythos Preview is Anthropic's frontier model, built for complex, extended reasoning. In this case, it worked autonomously on an advanced math problem.

A $100,000 API bill may seem high. But put it in context: two years of work by specialized human experts costs far more. And the model delivered a result those experts had not achieved.

This pattern, AI as an accelerator of security research, is set to repeat. Organizations that run critical infrastructure need to start seeing AI not only as a productivity tool, but as a variable in their own risk model.

According to Gartner, by 2027 more than 40% of critical vulnerabilities will be identified or exploited with the help of AI models. The window to adapt is getting narrower.

Immediate impact for Italian companies: no alarm, but strategic attention

First, let's be clear: the vulnerabilities found by Claude Mythos do not compromise the systems in use today. This is not an operational emergency for Italian SMEs or mid-market companies.

Still, the signal is clear. Companies that depend on digital infrastructure, such as e-commerce, B2B platforms and payment systems, need to start planning the move to post-quantum cryptographic standards. This applies especially to those handling sensitive data with long time horizons.

Marketing and digital leaders also need to understand that security is no longer just an IT topic. It affects customer trust, regulatory compliance and brand reputation. It becomes part of your overall digital strategy.

In this context, the AI consulting services from SHM Studio also include assessing the strategic implications of emerging technologies for our clients' business.

The race between defense and attack: a shifting balance

Anthropic's discovery raises a fundamental question: if AI models can find vulnerabilities, can they also exploit them? In theory, at least, the answer is yes.

However, there are important differences between finding a mathematical vulnerability and building a working exploit. Models like Claude Mythos are also designed with explicit ethical constraints. Anthropic published the results responsibly, following responsible disclosure practices.

On the other hand, malicious actors with access to less constrained models could use similar capabilities offensively. For this reason, the security community is speeding up the development of AI-assisted defenses. It echoes the history of antivirus software: the race between attack and defense never stops.

Companies' digital marketing and online presence strategies need to account for this scenario. That is especially true if you run campaigns on first-party data or platforms with advanced authentication.

What no one is saying openly yet

There is one aspect that the technical narrative tends to underestimate. The real change is not that AI found a vulnerability. The real change is the speed and the cost at which it did so.

60 hours versus two years. $100,000 versus millions in researcher salaries. This cost-effectiveness radically changes who can afford to do offensive security research. It lowers the barrier to entry for players who previously lacked the resources to compete.

This same principle applies to other domains too. An AI model's ability to analyze complex systems at low cost will reshape competition in many industries. Not just in cryptography.

If you're a marketing leader planning investments in web infrastructure, SEO and Google Ads campaigns, understanding this trajectory is part of strategic planning. It's not science fiction: it's the competitive landscape of 2026.

What to do now: three operational priorities

For digital and marketing leaders at Italian companies, we suggest three concrete actions in the short term.

• Map your cryptographic dependencies. Identify which company systems rely on algorithms that may be at risk in the medium term. This includes e-commerce platforms, CRMs and authentication systems.
• Start a conversation with your IT vendors. Ask your technology partners what their roadmap is for the post-quantum transition. A vendor without a clear answer is a risk.
• Follow regulatory developments. The European Commission is working on guidelines for post-quantum cryptography under the Cyber Resilience Act. Companies operating in the EU market need to stay up to date.

At SHM Studio, we help clients understand the strategic implications of AI. Our AI consulting and digital marketing services always start with an analysis of the technological and competitive context. If this is on your radar, get in touch and let's talk.

Outlook: AI as a tool for auditing digital security

Looking ahead to 2027-2028, it's reasonable to expect models like Claude Mythos to be built into cryptographic audit processes, much as they already are with automated penetration testing tools.

This will have positive effects: security research will become faster and cheaper. Organizations with fewer resources will also be able to reach levels of analysis once reserved for the big players.

However, the same democratization applies to the offensive side. That makes the regulatory framework and responsible disclosure practices even more critical. AI governance applied to security will be one of the central themes of the tech debate in the coming years.

To stay up to date on the latest in AI and digital marketing, follow the SHM Studio blog. And if you run B2B campaigns, the implications extend to your LinkedIn strategy and to producing SEO content that speaks with authority on these topics.