Late last month a team of cryptographers took a post-quantum signature scheme out of contention before it ever shipped, and they did it with an attack that left the research community quietly reassessing how much trust to place in the standards pipeline. The scheme was HAWK, a lattice-based digital signature candidate that had made it into the third round of the post-quantum selection process. The attack, reported under the name Mythos, cut its effective key strength in half and forced the authors to withdraw it.
What Mythos found
HAWK is a lattice-based signature scheme built on a structure with rich symmetries. Those symmetries are part of what made it fast, but they also turned out to be its fatal flaw. The Mythos team exploited automorphism symmetries in HAWK’s underlying lattice to recover information about the secret key. In concrete terms, they reduced the security of the scheme by about 50 percent, which is the difference between a candidate that looks comfortable and one that is nowhere near the safety margins NIST was hoping for.
The practical cost of the break matters too. The attack ran for roughly 60 hours and used about $100,000 of compute. That is not trivially cheap, but it is well within the budget of a well-funded lab, and it is the kind of number that tends to fall over time as attacks get refined. A security margin that requires six figures of compute to break today is not a margin anyone wants to rely on for decades of encrypted traffic.
Why this is more than one algorithm
The uncomfortable part is not that HAWK had a weakness. Every candidate that fails does. The uncomfortable part is how long it went unnoticed. According to the reports, the flaw survived years of review by humans before an AI-assisted tool found it in days. That flips the usual assumption on its head. The field has been operating as if careful human review is the bottleneck, and the reality may be that machine-assisted cryptanalysis is now the thing to fear.
This mirrors what the rest of security has been learning for years. Tooling that can grind through algebraic structure and hunt for symmetries is getting cheaper and smarter, and it is being pointed at exactly the algorithms that are supposed to anchor the next generation of trust. Post-quantum cryptography is being deployed precisely because the world expects classical systems to fall. It would be a poor joke if the replacements turned out to have holes that new cryptanalysis simply finds faster than the old ones did.
What it means for developers
If you are building on HAWK, or if you had begun evaluating it, the practical answer is simple: stop. It is withdrawn from the standardization process, and there is no path forward for it as a mainstream choice. The safer alternatives are the schemes that have survived deeper scrutiny, chiefly ML-DSA for digital signatures, along with the other algorithms that NIST has already standardized or moved toward final selection.
More broadly, the incident is a reminder to treat any announcement of a new signature or key-exchange scheme with a bit of caution. A candidate being fresh or fast is not a reason to adopt it. Adoption should track how much independent analysis it has survived, and in the post-quantum world that bar is higher than most projects are used to.
For teams mid-migration to post-quantum cryptography, the message is to stick with the algorithms that have the longest review history and the widest deployment. The ones that wrapped up NIST rounds years ago have had the most eyes on them. HAWK was never deployed at scale, which is why its failure is a research story rather than a production emergency. That is the best outcome you can hope for from a broken candidate, and it is exactly why the standard-setting process is worth the time it takes.
The broader lesson
The Mythos result is worth watching for two reasons. One is that AI-assisted cryptanalysis appears to be a real accelerant for finding weaknesses, which cuts both ways. It can shore up trust in survivors by showing they hold up, and it can shake trust in anyone still under review. The other is that it changes the cost equation for attacking new schemes. Years of human review no longer feel like enough protection on their own.
None of this means post-quantum cryptography is doomed. It means the field is getting honest about how hard it is to build things that stay secure, and that honesty is coming at the price of a few broken candidates along the way. If you are a developer, the takeaway is concrete: standardize on the survivors, keep an eye on the papers that come out of the research community, and do not let a flashy new scheme talk you out of boring, well-reviewed defaults.