Anthropic says one cryptographic attack cost it about $100,000 in API time. Its own price list says that is impossible.
Labs almost never publish what a task cost them. On July 28 Anthropic did, twice, in the same research post: roughly $100,000 per result, one billion output tokens, about 60 hours of work on one of them. Run those figures against the rate Anthropic publishes for the model that did the work and they do not survive contact. The output tokens alone bill $125,000, which is more than the whole result is supposed to have cost. That gap is worth understanding, because the explanation sits on Anthropic's own page and it tells you what these disclosures are and are not. Then the more useful question: priced on a card you can actually buy, where does the money in an agentic workload go?
What Anthropic actually published
The research post covers two findings: an attack on the HAWK post-quantum signature scheme, and an improved attack on 7-round reduced AES. Neither threatens anything you are running today, and Matthew Green's write-up is the read to have on what they do and do not mean cryptographically. Our interest is narrower: the cost paragraph, which most of the coverage skipped.
Anthropic states that "each of the results cost roughly $100,000 in API cost to develop". On the AES work Claude produced "several hundred million tokens" across three days, and the attack came good "after Claude output a total of one billion output tokens". The HAWK finding took "about 60 hours in total", spread over roughly a week, with human involvement "limited to project management". All of it ran on Claude Mythos Preview inside what Anthropic calls a "Claude Code-like harness that supports multiple worker agents collaborating together in a sandboxed environment". Anthropic never totals the programme, so treat the implied ~$200,000 across both results as our inference rather than a published figure.
The number that cannot be a bill
Claude Mythos Preview does have a published price, which is easy to miss because it is not on the pricing docs. It is on the Project Glasswing page, in Anthropic's own words: the model "will be available to participants of Project Glasswing at $25/$125 per million input/output tokens". That makes it the most expensive model Anthropic has ever put a number against, well above the $15/$75 that Opus 4.1 carries and the $10/$50 top of the generally available range.
Now multiply. One billion output tokens at $125 per million is $125,000. That is the output side alone, on the model Anthropic says did the work, and it already exceeds the $100,000 the company quotes for the entire result. Add input and it is not close. So the disclosed figure is not a list-price invoice, and reading it as one will mislead you.
The resolution is on the same page. Anthropic "committed $100M in model usage credits to cover Project Glasswing and additional participants throughout the research preview". Glasswing access is subsidised, and internal research spend is being accounted at something other than the sticker. That does not make the $100,000 meaningless. It makes it a cost-of-goods number rather than a customer invoice, which is arguably the more interesting of the two, and it is the reason the arithmetic below uses cards you can actually buy.
Where a hundred thousand dollars goes
Here is the exercise worth doing. Take the disclosed billion output tokens, price it against each Anthropic card, and see what is left over out of $100,000 for input. The subtraction is the whole trick, because input volume is the one thing nobody publishes and the one thing that sets an agentic bill.
| Priced as | 1B output costs | Share of $100k | Left for input |
|---|---|---|---|
| Mythos Preview list, $25 / $125 | $125,000 | 125% | Nothing, it overshoots |
| Fable 5 and Mythos 5, $10 / $50 | $50,000 | 50% | $50,000 |
| Opus 5, $5 / $25 | $25,000 | 25% | $75,000 |
Take the middle row, the highest-priced model you can actually sign up for. Output accounts for exactly half the budget. The remaining $50,000 buys input, and how many tokens that is depends entirely on cache hit rate: 5 billion at the full $10 uncached rate, 50 billion at the $1 cache-hit rate. So the input-to-output ratio on a workload like this sits somewhere between 5:1 and 50:1, and there is no reading of it where output is the expensive half.
On the cheaper Opus 5 card the tilt is sharper still. Output falls to a quarter of the budget and input claims $75,000, or 15 billion tokens uncached. Same direction whichever card you pick. This is the part worth internalising, because per-token comparisons are almost always argued on the output rate, and output is not what an agent spends its money on.
Why agents invert the usual ratio
A chat request bills its input once and its output once, and for most conversational traffic output dominates because the prompt is short and the answer is long. Agent loops break that symmetry completely. Every turn re-sends the accumulated transcript: the system prompt, the tool definitions, the file contents already read, the output of every command already run, plus whatever the model said last. Context grows monotonically, and it gets billed again on every single step.
Multiply that by a fleet. Anthropic describes multiple worker agents collaborating, and each worker carries its own context window through its own loop. They do share the static prefix, the system prompt and tool definitions, and that part caches well. What does not share is everything after the fork: each agent's own tool results, file reads and intermediate reasoning, which is the part that grows without bound. Thirty agents deep into a task are re-reading thirty divergent transcripts, and none of that shows up in an output-token count. The billion output tokens Anthropic disclosed is the visible tip of the workload.
We wrote about the discount side of this in the prompt caching breakdown, and the conclusion holds here: caching cuts the rate, not the shape. It works best when a large prefix stays byte-identical between calls, and an agent appending tool output is the workload least likely to satisfy that past the shared header. Cache writes on the $10/$50 card cost $12.50 per million, above the uncached input rate, so a loop that keeps invalidating its own prefix can spend more on caching than it saves.
A billion tokens is a throughput statement
It is easy to read "one billion output tokens" as a large total and move on. Put it against the clock and it says something more specific about how the work was shaped.
| Disclosed volume | Over | Sustained rate |
|---|---|---|
| 1 billion output tokens (AES) | 1 week | 1,653 tokens/sec |
| Several hundred million (call it 300M) | 3 days | 1,157 tokens/sec |
Both rows are AES figures. Anthropic never published a token count for HAWK, only the 60 hours, so there is no honest way to pair the two. Published third-party measurements put recent Claude models somewhere in the 40 to 80 output tokens per second range on a single stream. Holding 1,653 tokens per second for a solid week therefore needs somewhere around 21 to 41 concurrent streams running continuously, with no idle time. Call that an estimate rather than a measurement, but it is a useful sanity check on the harness description: this was not one clever agent thinking hard, it was a couple of dozen of them grinding in parallel for seven days.
One caveat on that comparison. Anthropic's docs note that its newer tokenizer produces roughly 30% more tokens for the same text, so a billion Mythos tokens is not the same quantity of English as a billion tokens measured on an older model. The stream count is a rough order-of-magnitude read, not a precise one.
Against the 60 hours of HAWK work, $100,000 comes to about $1,667 per hour of agent time, or roughly $28 a minute. What makes that look reasonable rather than absurd is Anthropic's own comparison: the model found the AES result in about a week, and then two researchers spent close to a month satisfying themselves it was correct, plus several hundred hours validating the HAWK claim. The human verification bill is the part that did not get cheaper.
Borrowing the ratio, not the total
Nobody reading this is about to spend $100,000 finding an AES attack. The transferable part is the ratio. If you are running anything agentic, a coding harness, a research loop, a document pipeline that calls tools, your bill is being set by input volume, and input volume is set by two things you control: how long each loop runs before it resets, and how many workers you run at once.
Go and look rather than estimate. Anthropic, OpenAI and Google all report input and output token counts per request, and the split is usually sitting in the console without any instrumentation work. Pull a week of agent traffic and compute the ratio. If it comes back at 10:1 or worse, model choice matters far less than you think, because you are shopping on the wrong column of the rate card. A model with cheap input and expensive output will beat its mirror image on this workload, and that is not how most comparisons get framed.
Calibrate the spread while you are at it. In April we covered Glasswing finding a 27-year-old OpenBSD bug for under $50. Same model, same broad category of work, four months apart, and the disclosed cost moved by a factor of at least 2,000. Agentic spend does not scale with how many tasks you run. It scales with how hard the hardest one is, and that tail is long enough that per-task averages will mislead you.
What makes this disclosure worth the attention is not the headline figure, which turns out not to be a price at all. It is that a lab published token counts and a dollar amount for the same piece of work, which almost never happens, and the two together let you check an assumption that usually goes unexamined. Put your own input and output counts in and see which side of your bill is actually doing the damage.
Sources
- Anthropic: Discovering cryptographic weaknesses - July 28 2026. The $100,000 per result figure, the billion output tokens, the 60-hour HAWK timeline, and the multi-agent harness description
- Anthropic: Project Glasswing - Claude Mythos Preview list price of $25/$125 per million, and the $100M model usage credit commitment that explains the gap
- Anthropic: Claude pricing - The $5/$25, $10/$50 and $15/$75 cards, cache rates, and the tokenizer note
- Matthew Green: Some thoughts about Anthropic's new cryptanalysis results - July 29 2026. Independent cryptographer's assessment of what the HAWK and AES findings do and do not mean
- TokenCost: Project Glasswing and Claude Mythos Preview - Our April coverage, including the OpenBSD bug found for under $50
- TokenCost: Prompt caching pricing in 2026 - Cache write and cache hit economics across providers