Mythos is the name attached to the research group reportedly responsible for the Möbius Bridge — the cryptanalytic technique that claims to break AES encryption. Beyond this, confirmed facts are scarce.
What We Know
The name "Mythos" first appeared in connection with the AES vulnerability through channels within the cryptographic research community. The group has not made public appearances, published a traditional academic paper, or given interviews.
This is unusual. Cryptographic breakthroughs of this magnitude are typically announced through:
- Academic conferences (CRYPTO, EUROCRYPT, ASIACRYPT)
- Preprint servers (IACR ePrint)
- Coordinated disclosure with NIST and affected vendors
Mythos has followed none of these channels.
Possible Explanations
Several theories circulate within the security community:
Academic researchers seeking responsible disclosure: Some breakthroughs are shared privately with governments and major vendors before publication, to allow mitigation before public exploitation. This would explain the lack of a paper and the industry's quiet acceleration of post-quantum timelines.
State-affiliated research: Governments invest heavily in cryptanalysis. A state actor might develop such a technique and selectively disclose it through unofficial channels, either to prompt migration or for strategic purposes.
Independent researchers: The history of cryptography includes significant contributions from individuals outside traditional academia (e.g., public-key cryptography concepts emerged independently from academia and GCHQ).
Why the Secrecy Matters
If the Möbius Bridge is real, the secrecy is actually understandable — and possibly responsible. Publishing a full working attack on AES before defenses are in place would be catastrophic. Every system still using AES would be immediately vulnerable. A coordinated, quiet disclosure allows:
- Critical infrastructure operators to begin migration
- Browser and OS vendors to ship post-quantum support
- Financial systems to prepare contingency plans
- Government agencies to assess national security implications
The Bottom Line
Not knowing who Mythos is makes verification harder, but it doesn't invalidate the claims. The most important question isn't who found the vulnerability — it's whether the vulnerability is real, and what we do about it.
The prudent response is the same either way: assess your exposure and begin hardening your security posture now.