Why the Age of AI Requires a Second, Physics-Based Layer of Cryptographic Defen
Recently, Anthropic published research demonstrating how its Claude Mythos Preview model found a materially improved attack against HAWK, a digital-signature scheme designed for the post-quantum era.
HAWK was not an obscure academic proposal. It had survived two rounds of expert review over approximately two years and, in May 2026, was selected as one of nine candidates advancing to the third round of NIST’s process for standardizing additional post-quantum digital-signature schemes.
Mythos found the weakness after approximately 60 hours of work.
The attack did not make HAWK immediately breakable in practice, but it effectively cut its security strength in half. The HAWK team confirmed that straightforward mitigations would make the scheme uncompetitive and withdrew it from NIST’s process the following day.
That is a remarkable sequence of events.
It is also important to be precise about what it does—and does not—mean.
This does not mean that PQC has been broken
HAWK was a candidate algorithm, not a deployed NIST standard. No production systems were affected.
NIST’s currently standardized post-quantum algorithms include ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures. Anthropic has expressly stated that the weakness it found in HAWK does not affect ML-DSA, Falcon or other related lattice-based schemes.
A perfectly valid argument can therefore be made:
HAWK was undergoing a public evaluation process. AI was used as part of that evaluation. A weakness was discovered before the algorithm was standardized or deployed. The process worked exactly as intended.
Nothing to see here.
That argument is fair.
It is also incomplete.
AI has changed the clock
The real significance of the Anthropic research is not that one candidate PQC algorithm was weakened. Cryptographic candidates have been weakened or eliminated before. That is precisely why serious algorithms undergo years of adversarial review.
The significance is the speed and scale at which this review can now occur.
According to Anthropic, Mythos conducted extensive literature analysis, mathematical reasoning, computational experimentation and implementation work with relatively limited human direction. Anthropic also demonstrated improved attacks against reduced-round AES and reported preliminary results against several other cryptographic constructions.
AI is becoming a powerful tool for defenders. It will help researchers test algorithms more extensively, examine obscure cryptographic implementations and identify weaknesses before systems are deployed.
But the same capability will be available to attackers.
And we cannot assume that every meaningful discovery will be responsibly disclosed.
The cybersecurity cat-and-mouse game has therefore accelerated dramatically. The cost of conducting sophisticated cryptoanalysis is falling, the number of actors capable of attempting it is increasing, and the time between hypothesis and working attack is shrinking.
The time required to update critical infrastructure has not undergone a similar transformation.
That asymmetry is the real problem.
Attackers need hours. Infrastructure owners need years.
Replacing cryptography in critical infrastructure is not equivalent to updating an application dependency.
Cryptography is embedded across protocols, applications, appliances, HSMs, firmware, certificates, identity systems, key-management platforms and vendor products. These components must continue to interoperate throughout any migration.
A cryptographic transition can require:
- Updated protocol negotiation and interoperability across vendors
- New certificates and PKI infrastructure
- HSM and secure-element upgrades
- Firmware or hardware replacement
- Application testing and recertification
- Regulatory approvals and updated security controls
- Carefully managed deployment and rollback plans
- Maintenance windows that preserve uptime and contractual SLAs
This is why NIST correctly emphasizes crypto agility: the ability to replace and adapt cryptographic algorithms across software, hardware, protocols and infrastructure while preserving ongoing operations.
Crypto agility is good engineering. Organizations should build cryptographic inventories, remove hard-coded dependencies, abstract cryptographic services and prepare for future transitions.
But crypto agility does not eliminate the transition.
It merely makes it less painful.
An attacker needs to exploit one meaningful weakness. A critical-infrastructure operator must safely upgrade an entire interconnected production environment.
AI is making the first task substantially faster. It is not making the second task fast enough.
I previously described the belief in effortless, plug-and-play cryptographic transitions as the “crypto-agility delusion.” AI makes that delusion considerably more dangerous.
The issue is not whether today’s PQC algorithms are secure
For the sake of the argument, let us assume that every PQC algorithm currently standardized by NIST is secure.
There is no publicly known reason today to assume otherwise.
The problem is that critical infrastructure is being designed around a security assumption that must remain valid for decades: that no sufficiently capable adversary will find a materially better attack against the selected mathematical problem, its parameters, its implementation or the protocols surrounding it.
Perhaps that assumption will hold.
But “perhaps” is not an adequate architecture for the most critical links in the global financial, telecommunications, cloud and government infrastructure.
The lesson from HAWK is not that mathematical cryptography has failed. It is that concentrating security in any single family of mathematical assumptions creates systemic exposure—particularly when AI is making those assumptions easier and cheaper to interrogate.
The rational response is not to abandon PQC.
It is to stop relying on PQC alone.
Why QKD provides a genuinely different layer
Quantum key distribution approaches the key-establishment problem differently.
PQC derives security from the assumed computational difficulty of a mathematical problem. QKD derives the security of its key-generation process from quantum mechanics, subject to the assumptions of the protocol, its security proof and the implementation.
During a QKD exchange, the endpoints measure characteristics of the quantum channel. Those measurements allow them to estimate and bound the information that a potential eavesdropper could possess. When the measured parameters fall outside the protocol’s secure operating bounds, the system does not generate usable key material.
This is sometimes loosely described as “detecting an eavesdropper.” More precisely, QKD determines whether the observed exchange can support a key with the required security bound.
The resulting security can be expressed using an explicit, measurable security parameter. It does not depend solely on estimating how much computing power an attacker may possess or whether a faster algorithm will be discovered in the future.
That does not make QKD magical or invulnerable.
Practical QKD systems must enforce the assumptions of their security proofs. Their hardware and implementations must be protected against side-channel and implementation attacks. QKD also requires an authenticated classical channel.
QKD does not replace digital signatures, identity, access control or PQC. HAWK itself was a signature scheme, a function QKD does not perform.
That is precisely why the correct architecture is not PQC versus QKD.
It is PQC plus QKD.
Defense-in-depth must include different security foundations
For most organizations, PQC should be deployed broadly across applications, endpoints and protocols. It is scalable, software deployable and necessary for replacing today’s quantum-vulnerable public-key cryptography.
QKD should be deployed selectively, where the impact of a cryptographic failure would be unacceptable and where the cost and complexity of an emergency migration would be greatest.
Examples include:
- Data-center interconnects
- Telecommunications backbone links
- Financial transaction infrastructure
- HSM-to-HSM and key-management replication
- Cloud on-ramps
- Government and defense networks
- Other crown-jewel links carrying high-value or long-lived information
In such an architecture, PQC and QKD can provide independent sources of key material that are securely combined before being used for symmetric encryption.
The objective is not to prove that one layer can never fail.
It is to ensure that failure of one layer does not immediately become failure of the system.
If a future cryptoanalytic advance weakens a PQC algorithm, the QKD-derived component continues to provide an independent security basis for the protected link. If the QKD infrastructure is disrupted or unavailable, the PQC layer continues to operate.
That is actual defense-in-depth: not two implementations resting on closely related mathematical assumptions, but two layers whose security fails differently.
Crypto agility remains necessary. It is no longer sufficient.
The Anthropic result should not lead organizations to panic about NIST’s current PQC standards.
It should lead them to reconsider an architecture in which discovering a weakness immediately triggers a race to replace cryptography across a large, interconnected production environment before attackers can exploit it.
That was already a risky assumption.
In the age of AI, it is becoming untenable.
Organizations must continue migrating to PQC. They must also become as crypto-agile as their operational environments realistically permit.
But for the links that cannot be allowed to fail, the security strategy cannot depend entirely on being able to migrate faster than an AI-enabled attacker can discover and exploit the next weakness.
Those links require an independent, physics-based layer of protection.
Not instead of PQC.
In addition to it.