AI discovers weaknesses in AES variant and post-quantum encryption

Artificial intelligence has identified new cryptographic weaknesses in both a variant of the Advanced Encryption Standard (AES) and a post-quantum digital signature scheme. The discovery, utilizing the Claude Mythos Preview model, suggests that AI can accelerate cryptanalysis, potentially identifying vulnerabilities in complex systems faster than traditional human-led research.

According to researcher Liam Debono and technical reports from Rescana, the AI discovered a faster attack on a 7-round reduced variant of AES-128 than any previously published method. While this attack targets a simplified version of the algorithm rather than the full production standard, the AI operated mostly on its own to find the efficiency gain. Additionally, the AI identified a weakness in the HAWK post-quantum digital signature scheme. This specific vulnerability significantly reduced the system's key strength, effectively halving it.

The Role of AES in Global Security

AES serves as the global gold standard for symmetric encryption, securing the vast majority of internet traffic and sensitive government data. Historically, finding even marginal improvements in attack efficiency against such systems required years of specialized human expertise and deep mathematical rigor. The transition from human-centric research to AI-assisted discovery represents a fundamental shift in how cryptographic resilience is tested.

Implications for Cybersecurity

These findings signal a potential paradigm shift in the cybersecurity landscape. If AI can autonomously uncover vulnerabilities in highly studied systems, the time-to-exploit for complex encryption could drop from years to hours. While full production AES remains unbroken, the ability of an AI to optimize attacks on reduced-round variants demonstrates a capability that could eventually be applied to more robust systems. This acceleration may necessitate a more urgent transition to quantum-resistant algorithms and a complete overhaul of how encryption standards are vetted.

Future Outlook

Industry experts are now monitoring whether these AI-driven techniques can be scaled to full-round encryption standards. While the HAWK vulnerability provides a concrete example of AI-driven key strength reduction, the broader impact on production-grade security remains to be seen. The primary question for the security community is whether AI will be used primarily as a tool for defenders to harden systems or as a weapon for attackers to dismantle them.