An AI Helped Find a Weakness in a Post-Quantum Candidate. What Should Singapore Teams Do?

CYBERSECURITY · BLOG 29

The HAWK case is a lesson in open review—not evidence that the post-quantum standards ready for deployment have been broken.

AI-assisted cryptanalysis just produced a result worth understanding. It did not break the cryptography protecting your business.

In July 2026, Anthropic reported that its Claude Mythos Preview model helped a researcher develop an attack against HAWK, a post-quantum digital-signature candidate in NIST’s evaluation process. HAWK was withdrawn before standardisation or deployment. NIST says the finding does not affect its finalized post-quantum cryptography standards. That distinction matters for every organisation beginning a quantum-safe migration.

What happened—and what did not

NIST advanced HAWK among nine candidates to the third round of its additional digital-signature evaluation on 14 May 2026. On 28 July, Anthropic published a research account describing how a researcher worked with Claude Mythos Preview to develop an attack on HAWK; the company says the model performed much of the exploration semi-autonomously in a tool-enabled research harness, with human guidance and verification. The HAWK team withdrew the scheme from consideration on 29 July. (NIST candidate update; Anthropic research.)

HAWK was a candidate, not a finalized standard. It was not the algorithm deployed in ordinary business systems. NIST’s current PQC page says the HAWK result does not affect finalized standards such as ML-KEM and ML-DSA, which it describes as ready for implementation. Anthropic likewise says the finding had no practical impact on today’s computer systems because HAWK was not deployed. (NIST PQC status; Anthropic research.)

The attack was specific to HAWK. Anthropic described it as an improved, still-exponential key-recovery attack, not a general break of post-quantum cryptography or lattice-based cryptography. The lesson is not “AI can crack encryption.” It is that AI tools may help researchers probe candidate designs—and the standards process must keep testing before deployment.

Why this is a useful signal for business leaders

1. A candidate is not a production recommendation. A scheme appearing in a public evaluation is not the same as a standard approved for deployment. Keep procurement and architecture decisions tied to published standards and current guidance, not a candidate name, vendor marketing claim or AI-generated recommendation.
2. Withdrawal before deployment is the review process working. Public cryptographic evaluation is intended to expose weaknesses while designs can still be changed. A candidate being withdrawn is a reason to track the process—not to abandon migration.
3. AI can assist research; it cannot certify security. Anthropic reports a specific assisted-research result. That does not remove the need for independent cryptographic analysis, implementation testing, interoperability checks and operational review. Treat model output as a research lead requiring human validation, not a security verdict.
4. Crypto agility is practical resilience. NIST’s migration guidance says organisations need to identify where vulnerable algorithms are used and plan replacement or updates. In Singapore, CSA also advises organisations to build flexibility so algorithms can be changed with less disruption. (NIST PQC; CSA advisory.)

Singapore’s quantum-safe work is moving from planning to pilots

CSA’s 14 October 2026 advisory says organisations exposed to quantum risk should aim to have a migration plan by the end of 2027, with migration encouraged by 2035. For Critical Information Infrastructure, CSA’s grant information specifies that owners must submit migration plans by 31 March 2027 and complete migration of CII systems by 31 December 2031; new CII procurement must factor in quantum-safe considerations from 2028. These are CSA guidance milestones, and applicability depends on an organisation’s systems and status. (CSA advisory; CSA grant details.)

CSA has also announced the Quantum-Safe Kickstarter Grant to support practical pilots. Its published page describes eligible Singapore-incorporated non-government organisations, priority for CII owners, and example projects such as cryptographic discovery and inventory, a bounded application migration, and migration work for OT or legacy systems. CSA states that funded pilots may last up to six months and are subject to its eligibility and project assessment. Check the official grant page for current criteria; do not assume an application is approved or that a particular vendor is endorsed.

The PQC Trust Path

A candidate being withdrawn before deployment is a signal to keep the review loop open—not a reason to stop migration.

HAWK was a candidate, not a finalized standard. NIST says finalized PQC standards are unaffected. Singapore dates summarise CSA guidance; confirm which milestones apply to your organisation.

A practical 90-day plan for Singapore organisations

Days 1–30: find where cryptography actually lives

• Executive sponsor / CISO: name an accountable owner and agree decision rights across security, architecture, procurement and business services.
• Enterprise architecture / platform teams: start a cryptographic inventory across applications, certificates, protocols, devices, hardware modules, cloud services and supply-chain dependencies. Prioritise systems protecting long-lived confidential data, internet-facing services and equipment that is difficult to replace.
• Procurement / vendor management: ask critical suppliers which finalized quantum-safe standards their products support, their upgrade roadmap, required testing, and compatibility or cost constraints.

Days 31–60: prioritise and test, not mass-replace

• Cryptography and security architects: map dependencies to business services; classify data by confidentiality lifetime and service criticality. Use CSA’s Quantum-Safe Migration Handbook and readiness resources.
• Application owners: choose one bounded, low-risk, non-critical application for a pilot. Test protocol and client interoperability, certificate and key-management workflows, performance, monitoring and rollback.
• Security assurance: independently review candidate configurations and vendor claims. Do not treat a model-generated algorithm choice or a successful demo as proof of security.

Days 61–90: turn evidence into a funded roadmap

• CISO + finance + service owners: rank work by confidentiality lifetime, exposure, business criticality, upgrade difficulty and vendor readiness. Record assumptions and unresolved dependencies.
• CII owners: align the plan with CSA’s published submission and completion milestones. Other organisations exposed to quantum risk should work toward a plan by end-2027 and assess the 2035 migration recommendation.
• Eligible Singapore organisations: review CSA’s Quantum-Safe Kickstarter Grant and decide whether a narrowly scoped discovery or migration pilot fits the published criteria. Build the roadmap independently of any grant outcome.

By day 90, aim to have an owner, an inventory for priority systems, vendor responses, a tested pilot plan and a costed sequence of changes. The first goal is visibility and safe change—not an organisation-wide algorithm swap.

What to do about AI in the cryptography process

If teams use AI assistants to review cryptographic code, specifications or vendor materials, set a clear boundary: AI can help generate questions, find inconsistencies or accelerate test-case exploration, but algorithm selection and security approval remain with qualified reviewers. Keep prompts and proprietary designs inside approved data-handling rules. Require reproducible evidence, independent review, tracked versions and human sign-off before changing production cryptography.

That recommendation follows from the HAWK case, but it is an operational interpretation—not a new NIST requirement. NIST’s status page says finalized standards are not affected; Anthropic says its result was scheme-specific. Avoid extrapolating one result into claims that current encryption or all PQC is broken.

How KIS can help

KIS describes its work as cybersecurity, compliance and digital trust. Its listed services include AI governance and model/data risk assessments, Security Assurance & Testing, security control reviews, source-code assessments and security roadmaps. For organisations assessing AI use in security work or planning a broader assurance roadmap, explore KIS services. KIS’s public service page does not claim a dedicated PQC implementation product; for algorithm and migration choices, use CSA/NIST guidance and confirm vendor support.

Sources

1. NIST — Post-quantum cryptography status page, including HAWK clarification and finalized-standard status.
2. NIST — Nine candidates advance to Round 3 of additional digital-signature evaluation, updated 29 July 2026.
3. Anthropic — Discovering cryptographic weaknesses with Claude, 28 July 2026.
4. CSA — Advisory on Quantum-Safe Migration for Organisations, 14 October 2026.
5. CSA — Quantum-Safe Kickstarter Grant, updated 14 October 2026.
6. KIS — Services, reviewed for current service language and CTA.