Nothing that happened this summer weakened the post-quantum algorithms that governments are now mandating. But cryptanalysts and their AIs are finding new results increasingly quickly, and that makes replaceability the property worth designing for.
In July, we wrote that post-quantum cryptography (or PQC for short) had stopped being optional. Deadlines across the US and Europe became enforceable, and every framework asked for the same first step: establish where cryptography is actually used.
Governments are setting concrete deadlines, and tech giants want to finish their migrations before the end of the decade. Hybrid post-quantum TLS is becoming standardized infrastructure. ML-KEM and ML-DSA, finalized by NIST as FIPS 203 and FIPS 204, are moving into operating systems, cloud platforms and mainstream cryptographic libraries.
Then came the summer. Over four days in late July, a post-quantum candidate that had already survived two rounds of expert review was attacked by three separate groups. Two of those three attacks were found by AI.
None of this weakens the algorithms in the mandates. ML-KEM and ML-DSA are untouched. What follows is the story of how algorithms like those earn confidence, and why that earning never stops.
Who is finding these new results?
On May 14, the National Institute of Standards and Technology (NIST) advanced a PQC candidate called HAWK into the third round of its additional-signatures standardization process. NIST expected that round to continue for about two more years.
On July 28, the frontier AI lab Anthropic disclosed a substantially improved key-recovery attack against HAWK. Their attack made use of a previously unexploited mathematical technique to reduce the so-called 'dimension' of the key-recovery problem to approximately half its intended value. This weakened it enough that straightforward fixes would have made it uncompetitive compared to the other candidates in the standardization process. The team behind HAWK withdrew it from this process the very next day.
Within hours of hearing about the Anthropic disclosure, a PhD student named Hengyi Luo announced that he could reduce the dimension to almost three quarters of its intended value. While not as damaging, his method was different from Anthropic's, pre-dated its public announcement, and was produced by GPT-5.6 with only minimal technical guidance from humans.
In a striking convergence, on July 31, academic cryptographers Guilhem Mureau and Alice Pellet-Mary shared an attack very similar to Luo's. The notable difference was that they found the attack themselves with minimal technical guidance from AI. It took them less than two person-months. Anthropic's run took roughly 60 hours and about $100,000 in API costs.
The first takeaway is that the standardization process is supposed to allow researchers (and their AIs) to find weaknesses. HAWK was never a finished standard. It was a candidate still being stress-tested, with roughly two years of scrutiny still ahead of it. Nothing in production depended on it. Its withdrawal is that process working. Weeding out the flawed algorithms is its entire purpose.
What happens after standardization?
Traditional cryptography has been subject to scrutiny for much longer than PQC. AES was adopted in 2001, and with its standardization process firmly in the rearview mirror, today's cryptographers rarely attack it head-on. Instead, they attack deliberately weakened versions, with some of the algorithm's internal rounds of scrambling stripped out. These reduced-round1 versions give researchers a better chance of finding something than the fully-fledged versions used in production.
Even so, progress against AES is rare. That is what made the second half of Anthropic's July 28 announcement notable. Its Mythos Preview AI model attacked a deliberately weakened version of AES hundreds of times faster than the previous best method.
According to Anthropic's post, one difficulty in discovering this new attack was convincing their AI that they had not given it an impossible task. Whenever Mythos Preview gave a prompt response arguing for something easier to do, the Anthropic staff had to encourage it to persist!
To be extremely clear, the new attack hasn't actually enabled a reduced-round version of AES to be fully broken2. Its improvement removes one costly guess from an existing key-recovery attack, but the remaining data and computational requirements are still enormous.
The attack cannot realistically be carried out end-to-end, let alone applied to the full version of AES used in production.
The second takeaway is that scrutiny does not stop when standardization ends. AES was not reviewed once and signed off. It is examined permanently, and the deliberately weakened versions are where that examination happens. What turns up there is an early warning to the cryptographic community, not a breach.
Migrating with agility
Migrating to PQC is becoming mandatory and there is an understandable temptation to treat this as a once-in-a-generation technology refresh: inventory RSA and ECC; replace vulnerable key exchange with ML-KEM; replace digital signature algorithms with ML-DSA; upgrade certificates, protocols and HSMs; check the compliance box; done!
But cryptography rarely cooperates with final states. As explored above, algorithms can be chipped away at, with new attacks improving upon prior attacks, and multiple cryptographers (human and AI) finding similar weaknesses in quick succession. HAWK is also a reminder that an algorithm does not need to be fully broken to become unusable. It only has to lose the advantage that justified choosing it. For CISOs, that means every choice of algorithm has a shelf life that cannot be predicted in advance.
The key question to ask is: if we learned tomorrow that we no longer wanted to use a certain algorithm, how long would it take us to replace it? The answer should not be that we need another five-year transformation program.
This is why the migration to PQC should be built upon a foundation of crypto agility. NIST defines this as being able to "replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations" (NIST CSWP 39).
The objective of crypto agility is controlled replaceability: knowing where cryptography is used, watching what happens to it, and being able to change it quickly and safely when policy or cryptanalysis demands it.
The third and final takeaway is therefore to design the migration to PQC so that adapting is cheap and straightforward.
This is a higher bar than merely becoming 'quantum ready.' But after the AI-fueled summer of 2026, it is clearly the much more viable way to proceed.
Terra Quantum helps organizations plan and carry out post-quantum migrations, starting with visibility over where cryptography is in use and how it changes. If you would like help with migrating, or with building crypto agility into your infrastructure, get in touch with our team.
Explanatory footnotes
1. AES stands for Advanced Encryption Standard. When AES is given a 16-byte block and a secret key, it produces 16 bytes of output that look random. With the same key, the operation runs backwards to recover the original. Without the key, an attacker cannot decipher the random block.
AES makes the data look random by putting it through numerous rounds of scrambling operations. In simple terms, the versions of AES that have fewer rounds are significantly weaker than the full version because the data haven’t been scrambled as thoroughly.
2. Cryptographers and cryptanalysts use the words ‘break’ and ‘broken’ in a different way to most people, including their cybersecurity colleagues. Colloquially, something is broken when it can no longer perform its intended function. For example, a cryptographic algorithm would be broken if it couldn’t protect your private data anymore. However, to understand the more technical, cryptanalytic usage of the word, we need to understand brute force attacks.
A brute force attack is one in which the attacker tries every possible input to the cryptographic problem until either the solution is found or they run out of time. Cryptographic algorithms are designed so that the average amount of time needed to find the solution is astronomically large, for example, hundreds of times the age of the universe.
Technically, a ‘break’ is any sort of attack that is faster or more efficient than a brute force attack. However, this does not mean that it is broken in the conventional sense of the word. Continuing the prior example, if the ‘break’ was hundreds of times faster than simply going through all the possibilities, it would still take the age of the universe to decipher the original data, so the ‘broken’ algorithm would still be able to keep your data private.
The main text attempts to convey that the reduced-round version of AES was only broken in the technical sense. It was not broken in the usual sense.