Google Quantum Research Cuts Qubit and Gate Estimates
Though reading the headline would suggest that Google used AI to reduce quantum computing requirements, a more impactful claim, particularly for security planners, involves a different set of figures: a resource estimate indicating that elliptic-curve cryptanalysis could be achieved with 1,175 logical qubits and over two million Toffoli gates. This estimate is significantly lower than previous figures, which ran into thousands of qubits and billions of operations. Both claims originate from the same laboratory, but neither means your encryption was compromised this week.
Let me clarify these claims, as the press often merges them into a single narrative.
The Claims Under Review
Google is associated with two distinct results here, both requiring separate scrutiny.
- A 2026 Google Research white paper, co-authored by Ryan Babbush, Craig Gidney, and their colleagues, presented a resource estimate for attacking 256-bit elliptic-curve cryptography. The paper suggested this would require approximately 1,175 logical qubits and more than two million Toffoli gates. This was published alongside a zero-knowledge proof intended to certify the result without revealing the circuit. See the arXiv version.
- A November 2026 study by Google DeepMind and Google Quantum AI utilized AI agents and Lean-checked proofs to reduce the combined qubit-and-gate costs for scientific programs. They reported a factor of 10.9 reduction for a fusion simulation, 8.08 for photochemistry, and 2.49 for a drug-metabolism model.
Teams of agents proposed quantum programs and then had to prove both their correctness and cost within Lean before a program was accepted. For instance, the fusion case saw a reduction from 5,650 to 4,374 logical qubits. This represents a measured reduction against a stated baseline, not a result from actual hardware execution.
Therefore, the AI story and the cryptanalysis story are not the same. The AI agents focused on chemistry and fusion applications. The widely discussed crypto number came from the earlier white paper, and its connection to AI is less direct than headlines might suggest.
What the Proof Certifies
A zero-knowledge proof verifies that a hidden circuit meets a specified resource budget without actually revealing the circuit itself. In essence, Google aimed to publish a cryptanalysis result and keep the exact attack method confidential. The proof was meant to instill trust in the reported numbers without disclosing the underlying details.
This proof initially failed upon its first release. Trail of Bits identified two flaws and managed to extract enough information to likely reconstruct the secret circuit, as extensively documented on the blog. One flaw allowed an attacker to bypass the Toffoli gate counter, which was specifically designed to guarantee the cost claim. Google subsequently released a corrected version. Scientific American explored the motivations behind researchers’ initial use of zero-knowledge proofs and why the technique drew scrutiny after the mathematical details were leaked, in its article on hidden results.
Here’s the crucial limitation for our assessment: a corrected proof only certifies that a circuit satisfies a resource budget on sampled inputs. It doesn’t certify that the circuit has been run on a quantum computer, nor does it certify a breach of deployed encryption. Furthermore, the white paper was self-published by the party most likely to benefit from a lower number, which warrants independent verification.
Independent Verification Findings
Independent checks have now been performed, and their results are particularly noteworthy.
External researchers reproduced Google’s hidden circuit in approximately 63 days. André Schrottenloher subsequently published an improved public algorithm. A separate collaborative effort, utilizing AI-based agent systems, nearly halved the Toffoli count compared to the original figure. The Swiss Institute of Artificial Intelligence covered both the proof’s failure and the open reproduction in its review.
This is where the “AI cut the requirements” narrative receives only partial credit. The reduction in Toffoli gates via AI agents stemmed from the independent community reproduction, not from Google’s initial zero-knowledge claim. The evidence provided doesn’t indicate that Google’s crypto number was AI-derived. The DeepMind AI work, which was indeed AI-driven, focused on chemistry and fusion.
These programs still require orders of magnitude more computational resources than early fault-tolerant machines can provide. The paper itself states that applications demand billions to quadrillions of operations, whereas first-generation processors are projected to handle roughly a million.
Now, consider these numbers in the context of hardware. The most advanced reported devices currently house just under 100 logical qubits. Consequently, an attack requiring 1,175 logical qubits currently has no machine to run on. While the estimate has improved, the necessary hardware has not materialized.
How This Estimate Pertains to Security Planners
Even lower estimates can still influence planning timelines, which is a concern for financial institutions. The reasoning often involves Mosca’s inequality and the “harvest-now-decrypt-later” scenario: if an adversary records encrypted traffic today, a future quantum machine could potentially decrypt it. Therefore, migration to quantum-resistant encryption must be completed before such capable hardware exists.
QNews reported on how Hong Kong’s banks monitor this timeline, though few are actively rushing the transition, in this piece about the HKMA-backed readiness paper. This survey should be regarded as sponsor-supported self-reporting, useful for understanding the migration-clock context but not as a definitive measure of urgency.
The migration target has been defined. NIST has standardized ML-KEM, ML-DSA, and SLH-DSA under FIPS 203, 204, and 205. These schemes are believed to be secure against known quantum attacks, though they aren’t proven unbreakable. Most deployments utilize hybrid modes that combine them with classical cryptography. QKD and QRNG serve different functions (key distribution and randomness, respectively) and don’t substitute for post-quantum signatures or key exchange. Tools for migrating algorithms across simulators and hardware are maturing, as demonstrated by efforts like Eigenkit’s deployment release.
What to Watch Next
The next steps involve technical scrutiny. This includes whether the improved Toffoli count withstands peer review, whether the logical-qubit definition and error-correction overhead in the estimate hold up under independent accounting, and whether a second team can reproduce the corrected proof’s scope. Though the resource estimate for ECC cryptanalysis has decreased, independent work confirmed the circuit, and AI agents demonstrably reduced costs in both the community reproduction and Google’s chemistry study. This represents a credible advancement in estimates. However, it’s not a demonstrated attack on deployed encryption, nor is it a scaled hardware run.
Therefore, plan according to the estimate, not the headline. For more information on migration timing and actual measurements, refer to QNews’s coverage of quantum security.