Recently, Milad Nasr and Nicholas Carlini used an AI model to improve an earlier attack on seven-round AES-128.

And Satoru Kanno (@satokan3) wrote a great explanation of the result in Japanese.

Here’s a walkthrough based on his blog post and my understanding of the results, in English.

TLDR: Don’t panic. It’s an incremental improvement to an impractical reduced-round attack. Full AES-128 remains unaffected.

But what’s interesting is how the researchers used an AI model to find the improvement.

What the result actually covers

Standard AES-128 has ten rounds.

But this attack stops after seven. So, this is not the real cipher. But studying reduced-round ciphers is a common practice in order to better understand the security margin of a primitive.

A better attack on seven rounds is useful research, but it says nothing alarming about the complete cipher.

The attack also needs about 2^105 carefully arranged plaintext blocks, all encrypted under the same unknown key. Just streaming that many 16-byte blocks at 1 TB/s would take roughly 20 trillion years.

And an attacker would have to collect them from real network traffic. Plus, they’d need access to an encryption oracle and the ability to choose a vast number of specially structured inputs.

That’s a lot to ask! So to be clear: this scenario is completely unrealistic. There’s no practical attack here. AES remains fine.

How the research happened

Nasr and Carlini have long records in security research. In particular, they recently coauthored ExploitGym, which tests whether AI agents can turn real software vulnerabilities into working exploits.

For this project, they used a custom research scaffold, sponsored by Anthropic (AI usage cost alone for that task was evaluated to about $100,000)

It gave the model access to papers, code, and experiments, and let long searches continue between human prompts.

And the early runs concluded that AES had already been studied too thoroughly to leave an easy improvement.

So, the team kept the search focused: they changed the instructions, rejected easier targets, and pushed the model to work on a publishable attack against seven rounds.

Their scaffold even let the model modify parts of its own agent loop.

And after three days, the output from one run contained the idea that became the Möbius Bridge.

Finally, a few more days of experiments refined it into the attack described in the paper.

The paper says the model produced the bridge, the optimization techniques, and the correctness arguments. Pretty cool.

It’s important to note that the AI model did substantial work inside the system the researchers built, but it didn’t independently decide to study AES or publish a result.

Nasr and Carlini spent several hundred hours, nearly a month, checking the claims and writing the paper.

They’re the researchers responsible for the work. The Claude Mythos model was a tool they used.

The expensive byte guess

The new attack builds on a 2013 meet-in-the-middle attack.

A meet-in-the-middle attack computes forward from the plaintext and backward from the ciphertext, then looks for a match in the middle. And in this case, a large precomputed table describes a four-round core of AES.

To reach that core, the older attack had to guess selected bytes from the outer rounds.

And one of those bytes had 256 possible values. For every candidate at this stage, the attack tried all 256 values and rebuilt the data for a table lookup each time.

The Möbius Bridge

Now, here’s the cool part, the shortcut. The AES S-box made it possible.

Because the S-box isn’t an arbitrary lookup table: it first inverts each byte in a 256-element finite field, then applies a fixed affine transformation.

And at this stage, the two sides of the attack see different versions of the same collection.

If an offline difference is called d, the paper’s bridge identity is g = s^2 * d^-1 XOR s, where g is the corresponding online value and s is an unknown byte shared by the entire collection.

As a function of d, this is a particular Möbius transformation.

The researchers then take the reciprocals of the offline differences. If v = d^-1, the relationship becomes the affine map v -> s^2 * v XOR s.

The Möbius Bridge replaces the collection with a fingerprint that stays identical under that shared transformation. The individual values change, but the fingerprint doesn’t.

The attack can therefore check the precomputed table without trying all 256 values of the key byte first.

The formula in the diagram describes the relation between two collections when the surrounding key guesses are correct. It doesn’t describe complete AES states.

The bridge doesn’t remove the byte from the final key: it removes the 256-way guess from this table-lookup stage, and a later step recovers the byte.

Other key guesses remain, and bytes that pass through MixColumns don’t preserve the same convenient relation.

Removing the loop suggests a 256-fold speedup. But it’s important to note that computing the fingerprint is expensive, so some of that gain disappears.

After several optimizations, the estimated speedup is about 200 to 800 times. Pretty impressive, but once again, that has no practical impact.

The data still dominates

For the same 2^105 chosen plaintexts and a roughly 63 percent chance of success, the estimates are:

Attack	Chosen plaintext blocks	Estimated AES-equivalent work
Previous attack	2^105	2^99
Möbius Bridge	2^105	2^89.3 to 2^91.4

That’s a large reduction but the impossible 2^105 data requirement hasn’t changed, so data remains the dominant cost.

What has actually been tested

Obviously, the complete attack has never been run because it’s far too expensive. So, the researchers tested its components instead. See the code they released.

The researchers also ran an end-to-end attack on a toy cipher based on AES with a 24-bit key.

For full-size seven-round AES-128, they recovered 50 out of 50 planted keys, but it skipped the two parts that can’t be run at full scale.

It used the one table entry that should match and to identify the rare plaintext pair that the complete attack would have to find.

A Lean theorem checks the core bridge identity, while large computational experiments test the fingerprint’s behavior. Cool, but neither proves the complete attack.

We should emphasize that Anthropic published the work as a technical report rather than a peer-reviewed paper. Cryptographers outside Anthropic commented on an early draft, but broad independent review has only just begun. The full attack is too expensive to validate on actual hardware.

That being said, the work remains a clever incremental result in reduced-round AES cryptanalysis.

These results show that a capable AI model can be a useful tool when experienced people choose the problem, give it room to explore, and check every important claim.