Skip to content

Reviewed edition · qasb report 10/2026 · Topic report · Crypto and quantum

Cryptography and quantum: weaknesses mainly in implementations

A break of the ML-KEM, ML-DSA and SLH-DSA standards is not evidenced. Weaknesses showed up in libraries, devices and legacy TLS configurations. Quantum computing made progress on building blocks, not on attacks.

Published
October 27, 2026 · as of October 26
Reading time
16 min
Publisher
qasb Research
Method
qasb methodology v1

Key findings

  1. 2030is the year by the end of which the Dutch central administration is to migrate high-risk use cases.27Evidence: observed
  2. 640domains in the Tranco top one million were vulnerable to a Bleichenbacher variant with RSA key exchange, per the study.4Evidence: observed
  3. 1.85-folderror suppression by a larger code was the best a preprint measured on IBM cloud hardware, far too little for attacks.39Evidence: observed
  4. about 4.6×as many physical qubits as usually estimated would be needed at the median to attack RSA-2048, per a model calculation.33Evidence: model estimate

1.0Summary

The BSI, the UK NCSC and the Dutch government issued recommendations and timetables for the migration to post-quantum cryptography in October 2026. The sources describe AI assistance with proofs, attack ideas and circuits.

  • The BSI advises against new use of Classic McEliece for now, and the NCSC recommends hybrid post-quantum key agreement for TLS 1.3.
  • Most of the implementation attacks described here need physical access or legacy configurations, for example with TPM-based disk encryption or RSA key exchange.
  • Per a model calculation, attacks on RSA-2048 would need more qubits than usually estimated, even without its assumed 30% surcharge (then about 2.9 times as many at the median).
  • How AI was involved is often described only by authors or vendors, mostly in preprints without peer review.

2.0Starting point: recommendations, deadlines and funding

A quantum attack on deployed schemes is not evidenced, yet the migration is being planned. The Netherlands set target dates up to 2035 for its central administration, and the BSI and NCSC issued recommendations. For TLS signatures and certificates, the NCSC still recommends ECDSA and RSA until post-quantum schemes are standardised for them. The US announced funding for validation tools for fault-tolerant computers.

Figure 1

Recommendations and deadlines for the post-quantum migration

Recommendations from October 2026 and target dates for the Dutch central administration up to 2035

  1. Oct 2026BSI notice on Classic McElieceThe BSI advises against using the scheme in new developments for the time being; according to the BSI, the results so far do not allow a practical attack on the recommended parameter sets.
  2. Oct 2026Dutch quantum strategyNine ministries present a timetable; by the end of 2026 agencies are to include quantum risk in their risk management.
  3. Oct 2026NCSC guidance, version 1.2Hybrid post-quantum key agreement recommended for TLS 1.3 as an interim measure, pure ML-KEM also considered acceptable.
  4. 2027Target: migration planning(Draft) migration planning for the central administration is due by the end of 2027.
  5. 2028Target: quantum-safe procurementBy the end of 2028 the administration is to be able to require quantum-safe cryptography in procurement.
  6. 2030Target: high-risk use cases migratedHigh-risk use cases are to be migrated by the end of 2030. The AIVD and RDI advise preparing as early as around 2030 for quantum computers able to break today’s, mainly asymmetric, cryptography.
  7. 2035Target: medium-risk use cases migratedMedium-risk use cases are to follow by the end of 2035. According to international assessments, a quantum computer able to break today’s, mainly asymmetric, cryptography is expected in 2029 to 2035.
The target dates from the end of 2026 apply to the Dutch central administration and are not a law; deviations are possible, funds are to come from existing budgets, otherwise targets are adjusted. The BSI and the NCSC give recommendations, not a measurement of uptake; the BSI notice is preliminary.Evidence: observed · Sources 3, 7, 24, 27

Since 1 October 2026 the BSI has advised against using the post-quantum key agreement scheme Classic McEliece in new developments or when planning new cryptographic applications for the time being, after cryptanalysis of the scheme made significant progress in 2026; according to the BSI, the results so far do not allow a practical attack on the parameter sets recommended in Technical Guideline TR-02102-1.3,24A1

On 5 October 2026 the Dutch government presented a cross-government quantum strategy that gives the central administration a timetable for migrating to post-quantum cryptography: (draft) migration planning by the end of 2027, the ability to require quantum-safe cryptography in procurement by the end of 2028, migration of high-risk use cases by the end of 2030 and of medium-risk ones by the end of 2035.27A2

Older context study: on 15 October 2026 (version 1.2) the UK NCSC extended its TLS guidance, which has existed since July 2021, with post-quantum recommendations: for TLS 1.3 it recommends the hybrid key agreements X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024 from RFC 10024 as an interim measure and also considers pure ML-KEM (MLKEM768, MLKEM1024) acceptable; according to the NCSC only TLS 1.3 protects against quantum attacks when configured correctly.7A3

Further findings

  • A September call by the US Department of Energy plans USD 45 million for validation tools for fault-tolerant computers.28A4

3.0Implementations: where attacks take hold

The papers in this chapter concern side channels, flaws in libraries, certificates, legacy TLS configurations and disk encryption. None of them shows a break of the FIPS 203, 204 or 205 standards. In most cases an attacker needs physical access to the device or an outdated configuration. All papers were checked on their abstracts only, and most have not been peer reviewed.

Figure 2

Key recovery from a single trace for MILENAGE, the authentication algorithm on mobile USIM cards

Share of successful attacks by solving method, profiled side-channel attack, October 2026 preprint

All three methods build on neural-network predictions; the comparison shows the gain from combining them, not the contribution of AI. The abstract does not say whether real cards were measured; no uncertainty reported, not peer reviewed.Evidence: observed · Sources 20

According to an October 2026 paper, a new variant of the Bleichenbacher attack on RSA PKCS#1 v1.5 encryption completed 68.3% of runs within 30 seconds under realistic conditions with only one vulnerable server (2.6 ms median round-trip time), whereas prior algorithms completed none; the authors found 640 vulnerable domains in the Tranco top one million.4A5

An extended version, published on 24 October 2026, of a workshop paper by BSI authors presented in August 2026 demonstrates passive and active attacks on TPM 2.0-based full-disk encryption with which the authors break BitLocker on Windows and all current Linux implementations, including those that encrypt the bus communication.19A6

A preprint from late September 2026 points to previously reported incorrect implementations of the Fujisaki–Okamoto check in deployed ML-KEM and Kyber libraries (pqc_kyber and cosmian_kyber: RUSTSEC-2026-0290 and -0288; wolfSSL: CVE-2026-10097 and CVE-2026-6330) and shows that a single unverified ciphertext coordinate suffices to recover the key with a few hundred thousand decapsulation queries.11A7

An October 2026 preprint recovers the subscriber key K and the operator value OPc of the MILENAGE authentication algorithm used on USIM cards in mobile networks from a single trace; a hybrid of belief propagation and a SAT solver succeeds in 93.8% of attacks.20A8

Further findings

  • Per a preprint, one trace yielded the key of an ML-DSA implementation on a microcontroller in 99% of cases, with a 2^70 search budget.5A9
  • According to a preprint, about 2,200 traces after profiling yielded the key of a first-order masked Kyber768 implementation.9A10
  • A preprint recovered the secret seed of an SLH-DSA implementation with SHAKE from power consumption, on average from 280 to 559 signatures.10A11
2 more findings
  • If a quantum computer breaks a traditional CA key, Catalyst certificates can be swapped for traditional-only ones, according to an analysis.8A12
  • Researchers report the first formal verification of the additive FFT routines in Classic McEliece and HQC.18A13

4.0Cryptanalysis: new ideas, no break of deployed schemes

AI tools helped produce proofs, vulnerability findings and attack ideas, while other papers lowered cost estimates or accelerated known attacks. No paper breaks a deployed scheme. The statements on the role of AI mostly come from the authors or vendors, and none has been confirmed independently. The vulnerabilities in the Chinese competition concern new candidates, not deployed standards.

Figure 3

The first week of the NGCC competition

First-round candidates and vulnerability findings made public, according to a preprint

The findings concern new candidates, not deployed standards. The role of AI is described by the author, whose project reported the 110 findings; it has not been independently confirmed.Evidence: observed · Sources 6

A paper that, according to its authors, was developed with AI tools and has not been peer reviewed presents proofs of subexponential classical algorithms that recover secret key components in growing parameter families; these families are associated with all seven third-round NIST lattice candidates, including Kyber/ML-KEM and Dilithium/ML-DSA. According to the authors, the results do not establish a reduction in the concrete security of the specified parameter sets.2A14

According to a preprint of 30 September 2026, in the first week after the 119 first-round candidates of China’s NGCC cryptography competition were published on 20 September 2026, 191 vulnerability findings for 89 candidates became public, 78 of them rated critical; the author’s evaluation effort found, verified and disclosed 110 of them using an agentic AI workflow.6A15

According to an analysis, the AI tool DeepDistinguisher, meant to tell Goppa codes from random codes, partly relies on an artefact of the training data.

Older context study: a preprint submitted in August 2026 and last revised on 13 October describes the structural attack HOVER on McEliece keys, whose main shortcut according to the author was found with a large language model; with it the author recovered the keys of five McEliece challenges of the Technology Innovation Institute, including TII-252.21A16

An analysis published in October 2026 of the AI tool DeepDistinguisher, which is meant to tell Goppa codes (the basis of the McEliece scheme) from random codes, shows that the transformer model partly relies on an artefact of the training data and suggests that it exploits general combinatorial properties rather than hidden algebraic structure.14A17

Further findings

  • OpenAI claims a model-generated proof on matrix multiplication without peer review, and no weakening of ML-KEM is shown.15,16A18
  • Per a preprint, an attack on HSS/LMS and XMSS with SHA-256 at 2^64 signatures would need about 2^166 instead of 2^256 calls, far too many.13A19
  • A preprint lowers the estimated security of the signature candidate MAYO by about 6, 4 and 2 bits, depending on the variant.12A20
2 more findings
  • According to a preprint, Pollard rho for ECC2K-130 runs about 230 times as fast on a Blackwell GPU as in 2010, but the task is not solved.23A21
  • According to a preprint, proposed semiprimality certificates reveal the factors under certain conditions.22A22

5.0Quantum computers: progress on building blocks

There was progress on error correction, encoded computations and links between processors, not on attacks. A model calculation finds common resource estimates too narrow and too optimistic: by its account, attacks would tend to need more qubits. It relies, however, on older circuit counts and a surcharge set on the error rate.

Quantinuum demonstrated quantum error correction with colour codes of distance 3, 5 and 7 below threshold on its Helios trapped-ion processor: the logical error rate fell by about a factor of 12 per distance step, reaching about 5·10^-6 per syndrome round at distance 7.26A23

Researchers from Pacific Northwest National Laboratory and other institutions measured logical error suppression on a cloud-accessible IBM processor (Nighthawk r2): increasing the protected distance from 3 to 6 lowered the logical error per round from 0.53% to 0.24% (Z memory) and from 0.52% to 0.22% (X memory), corresponding to suppression factors of 1.68 and 1.85.39A24

Whether a preprint by Daniel R. Simon delivers a polynomial-time quantum algorithm for lattice problems such as LWE is openly disputed.

An uncertainty analysis from October 2026 concludes that common resource estimates for quantum attacks on RSA-2048, ECC-256 and AES-256 are too narrow and too optimistic: with an assumption derived from measured error rates (median about 4·10^-3 instead of the conventional 10^-3) the 90% interval for the required physical qubits spans a factor of about 40, and for RSA-2048 its median lies about 4.6 times above the conventional point estimate.33A25

Older context study: whether the preprint by Daniel R. Simon (Amazon Web Services), presented in August 2026 and last revised on 8 October, delivers a polynomial-time quantum algorithm for the dihedral coset problem and thus for lattice problems such as LWE is openly disputed: a rebuttal by researchers at MIT, Google and Stanford University states that it shows, with Lean 4 code, that the algorithm cannot work; in October the author added a note addressing these objections.37,38A26

Further findings

  • On an IBM processor researchers entangled two logical qubits with Bell fidelities above 93%, relying on post-selection.30A27
  • On Helios-1, encoded adders of up to three bits ran with fewer errors than unencoded ones, with faulty runs discarded.29A28
  • In its own study IBM linked two processors over 80 cm of cable, and CZ gates between them reached a mean fidelity of 94.75%.31A29
1 more finding
  • A leaner variant of Regev’s algorithm still needs more qubits than the leading implementations of Shor’s algorithm.32A30

6.0AI as a tool: curve seeds, proofs and circuits

The sources in this chapter describe AI involvement in tracing where the NIST curve seeds came from, a machine-checked proof, the search for circuits and codes, decoding and the calibration of very small devices. None of these findings is an attack on deployed schemes. The circuit search and the calibration are not compared with a procedure without AI.

Figure 4

Neural decoder versus the standard method

Logical error per round on an IBM Nighthawk-generation processor, same measurement data

Lower values are better, no uncertainty reported. At distance 5 the error was higher than at distance 3, so the device was not operating below threshold in this experiment. Classical machine learning, not a language model, not peer reviewed.Evidence: observed · Sources 34

According to Anthropic, an internal Claude research model worked out in under half an hour in October 2026 how the previously unexplained seeds of the NIST curves P-192, P-224, P-256, P-384 and P-521 were produced: as outputs of the C random number generator lrand48, started from Unix timestamps from 1997/98. The stated starting values reproduce all five published seeds exactly.1A31

In a search procedure in which the language model Claude Mythos 5 (Anthropic) proposed quantum circuits and an independent evaluator tested them, a new circuit for modular inversion emerged: with it, a point addition on the 256-bit curve secp256k1 needs 935 qubits and 4.0 million Toffoli gates; earlier constructions needed 1,446 qubits and 1.9 million, or 838 qubits and 70 million Toffoli gates.25A32

Researchers at MIT presented in October 2026 what they describe as the first end-to-end machine-verified composable finite-key security proof for entanglement-based qubit BB84 against coherent attacks; they developed the Lean proof with language-model agents and used the same pipeline to find a tighter variance bound that reduces the finite-size penalty.17A33

A modular neural decoder developed at the University of Gothenburg and Chalmers University roughly halved the logical error per round at distance 3 on an IBM Nighthawk-generation processor compared with the standard minimum-weight perfect matching method (1.47% versus 2.79% and 1.26% versus 2.60%) and came close to the AlphaQubit decoder on public Google data.34A34

Further findings

  • 87.18% of language-model codes with positive distance had distance 5 or more, random searches up to 74.26%, but found more code classes.35A35
  • With human interventions, an AI agent transferred the calibration to four three-qubit processors, without a comparison with manual work.36A36

7.0Evidence

Not every statement in this report is equally well supported. The table shows the key statements with their evidence type, AI relationship and sources.

StatementEvidenceAI linkSources
Since 1 October 2026 the BSI advises against Classic McEliece in new developmentsobservednot demonstrated3,24
2030 is the year by the end of which the Dutch central administration is to migrate high-risk use casesobservednot assessed27
640 domains in the Tranco top one million were vulnerable to a Bleichenbacher variant with RSA key exchange, per the studyobservednot assessed4
Attacks break TPM-based full-disk encryption on Windows and Linuxobservednot assessed19
AI-assisted proofs on lattice families, no established weakening of the parameter setsopendemonstrated2
NGCC: 191 findings in the first week, 110 of them via an agentic AI workflowobserveddemonstrated6
1.85-fold error suppression by a larger code was the best a preprint measured on IBM cloud hardware, far too little for attacksobservednot demonstrated39
about 4.6× as many physical qubits as usually estimated would be needed at the median to attack RSA-2048, per a model calculationmodel estimatenot demonstrated33
Whether Simon's quantum algorithm for the dihedral coset problem works is disputedopennot assessed37,38
According to Anthropic, a Claude model traced the origin of five NIST curve seedsobserveddemonstrated1

The 36 reviewed statements from 39 original sources fall into chapters 2.0 (4), 3.0 (9), 4.0 (9), 5.0 (8) and 6.0 (6), of which 28 observed, 5 model estimate, 3 open. The scope and limitations of every statement are listed in the appendix (A1 to A36).

Original sources checked on October 26, 2026.

8.0What organisations can do now

  1. Plan the migration: record schemes and rank them by risk. The Netherlands set their central administration targets of planning by the end of 2027 and migrating high-risk use cases by the end of 2030; the BSI advises against new use of Classic McEliece for now.
  2. Plan for TLS 1.3 with hybrid key agreement, as the NCSC recommends as an interim measure. Anyone still allowing RSA key exchange should review this; a new Bleichenbacher variant relies on exactly this compatibility.
  3. Check implementations, not just schemes: the weaknesses concerned libraries, microcontrollers and TPM-based disk encryption. Follow security advisories for the libraries in use and assess separately any devices that others can physically access.
  4. Assess reports soberly: many results are preprints without peer review or vendor claims, including on the role of AI. Base planning on recommendations from authorities such as the BSI and the NCSC, not on individual reports of breakthroughs.

9.0Method and limitations

Reporting period: October 1, 2026 up to the data cutoff of October 26, 2026 at 1:00 PM GMT+1 (Berlin time). This topic report is published before the end of the month; sources published after the cutoff follow in the next edition of the series. Compiled: October 27, 2026 at 12:23 AM GMT+1. This is the first baseline. The sources come from different years; their publication dates are not events in the reporting month. No change from an earlier edition was measured.

The report uses only reviewed public original sources. Customer conversations, private dossiers and personal customer assessments are not inputs. Observed, model estimate, scenario and open describe the evidence for each finding. Source values retain their original units and baselines; they are not combined into an overall score.

Editorial approval: qasb editorial team · Approved: October 27, 2026 at 12:25 AM GMT+1. The editorial presentation arranges the reviewed statements and contains no figure that is not in them. Presentation approved by the qasb editorial team · October 27, 2026 at 2:27 PM GMT+1.

Limits

  • This topic report covers two topic areas: “Cryptography and mathematics” and “Quantum developments”. It is not an exhaustive survey of all studies or incidents.
  • A narrow study finding is not a forecast for a particular customer, occupation or security system.
  • No qualified finding does not prove no effect; source-access gaps are disclosed separately.
  • This report contains no illustrative measurement series or invented confidence rating.

10.0Sources

  1. 1Claude reveals ECDSA curve originsAnthropic Frontier Red Team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis)October 16, 2026www.anthropic.com/research/ecdsa-curve-origins
  2. 2Provable Subexponential Algorithms for NIST Third-Round Lattice Families (auch IACR ePrint 2026/2386)Yiming Gao, Xuyuan Han, Honggang Hu, arXiv-Preprint 2610.11254October 8, 2026arxiv.org/abs/2610.11254
  3. 3Notes on recent developments concerning Classic McElieceBundesamt für Sicherheit in der Informationstechnik (BSI)October 1, 2026www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Notes_Classic_McEliece.html
  4. 4Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical Again (IACR ePrint 2026/2414)Youheng Lü, Lorenz Hetterich, Riccardo Zanotto, Cas Cremers, Michael Schwarz, Lukas Gerlach, IACR Cryptology ePrint ArchiveOctober 11, 2026eprint.iacr.org/2026/2414
  5. 5Non-profiled Single-Trace ML-DSA Secret Key Recovery by Horizontal Distribution Analysis (IACR ePrint 2026/2643)Linus Backlund, Elena Dubrova, IACR Cryptology ePrint ArchiveOctober 26, 2026eprint.iacr.org/2026/2643
  6. 6Chinese NGCC Algorithms: The First Week of AI Cryptanalysis (IACR ePrint 2026/2266)Markku-Juhani O. Saarinen, IACR Cryptology ePrint ArchiveSeptember 30, 2026eprint.iacr.org/2026/2266
  7. 7Using Transport Layer Security to protect data (Version 1.2 vom 15.10.2026)National Cyber Security Centre (NCSC), Vereinigtes KönigreichJuly 21, 2021www.ncsc.gov.uk/guidance/using-tls-to-protect-data
  8. 8An Analysis of the ITU-T Multiple Cryptographic Algorithms X.509 Extensions for PQC Migration (IACR ePrint 2026/2297)Falko Strenzke, IACR Cryptology ePrint ArchiveOctober 1, 2026eprint.iacr.org/2026/2297
  9. 9Breaking First-Order Masked Kyber with Belief Propagation Alone (IACR ePrint 2026/2448)Vahid Jahandideh, Lejla Batina, IACR Cryptology ePrint ArchiveOctober 14, 2026eprint.iacr.org/2026/2448
  10. 10SHAKEing SLH-DSA with Non-profiled SCAs (IACR ePrint 2026/2584)Rafael Carrera Rodriguez, Jad Zahreddine, André Monthieu, Aurélien Vasselle, Pierre-Yvan Liardet, IACR Cryptology ePrint ArchiveOctober 24, 2026eprint.iacr.org/2026/2584
  11. 11One Unverified Coordinate Is Enough: Key Recovery from Faulty Fujisaki–Okamoto Rejection Checks in ML-KEM (IACR ePrint 2026/2239)Bhabani Sankar Das, IACR Cryptology ePrint ArchiveSeptember 30, 2026eprint.iacr.org/2026/2239
  12. 12Geometric Forgeries: Structural Cryptanalysis of MAYO (IACR ePrint 2026/2247)Massimo Ostuzzi, IACR Cryptology ePrint ArchiveSeptember 30, 2026eprint.iacr.org/2026/2247
  13. 13A Kelsey–Kohno Attack Variant against SHA-2 Message Digests in HSS/LMS and XMSS (IACR ePrint 2026/2635)Falko Strenzke, IACR Cryptology ePrint ArchiveOctober 26, 2026eprint.iacr.org/2026/2635
  14. 14Analysis of an AI based code distinguisher (IACR ePrint 2026/2556)Quentin Lavit, Julien Seinturier, Pascal Véron, IACR Cryptology ePrint ArchiveOctober 20, 2026eprint.iacr.org/2026/2556
  15. 15An Upper Bound of 9/4 for the Matrix Multiplication Exponent (Manuskript im Repository openai/math, Ergebnisfamilie 107)OpenAIOctober 6, 2026github.com/openai/math/blob/main/preprints/Matrix-Multiplication-Nine-Fourths-October-2-2026/paper.pdf
  16. 16Faster Matrix Multiplication Leads to Faster Lattice Sieving (IACR ePrint 2026/2622)Yiming Gao, Honggang Hu, IACR Cryptology ePrint ArchiveOctober 26, 2026eprint.iacr.org/2026/2622
  17. 17Quantum Cryptography and Autoformalization in LeanMaor Ben Shahar, Jonathan Morag, Dirk Englund, Kfir Sulimany (MIT), arXiv-Preprint 2610.17286October 12, 2026arxiv.org/abs/2610.17286
  18. 18Functional Verification of Additive FFT Assembly Implementations in Code-Based PQC (IACR ePrint 2026/2307)Jiaxiang Liu, Kuang-Lin Pan, Xiaomu Shi, Ming-Hsien Tsai, Bow-Yaw Wang, Bo-Yin Yang, IACR Cryptology ePrint ArchiveOctober 4, 2026eprint.iacr.org/2026/2307
  19. 19Active and Passive Attacks against TPM 2.0-based Full Disk Encryption (IACR ePrint 2026/2579)Sven Freud, Lennart Hein, Dominik Klein, IACR Cryptology ePrint ArchiveOctober 24, 2026eprint.iacr.org/2026/2579
  20. 20A Hybrid BP-SAT Attack on MILENAGE: Combining the Complementary Strengths of Algebraic and Soft-Analytical Side-Channel Attacks (IACR ePrint 2026/2487)Elena Dubrova, Sönke Jendral, Linus Backlund, Mats Näslund, IACR Cryptology ePrint ArchiveOctober 15, 2026eprint.iacr.org/2026/2487
  21. 21HOVER: Higher-Order Vanishing Endomorphism Recovery (IACR ePrint 2026/1778)Markku-Juhani O. Saarinen, IACR Cryptology ePrint ArchiveAugust 22, 2026eprint.iacr.org/2026/1778
  22. 22When Elliptic-Curve Semiprimality Certificates Reveal Factors (IACR ePrint 2026/2620)Giuseppe Vitto, IACR Cryptology ePrint ArchiveOctober 24, 2026eprint.iacr.org/2026/2620
  23. 23Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell (IACR ePrint 2026/2469)Adam Buran, Kevin Nguyen, IACR Cryptology ePrint ArchiveOctober 14, 2026eprint.iacr.org/2026/2469
  24. 24Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidenceRamses Fernandez, arXiv-Preprint 2610.31196October 22, 2026arxiv.org/abs/2610.31196
  25. 25Discovering state-of-the-art quantum circuits with large language modelsAndi Gu, Alek H. Kemeny, Susanne F. Yelin, Mikhail D. Lukin (Harvard University, Anthropic, QuEra Computing), arXiv-Preprint 2610.22367October 15, 2026arxiv.org/abs/2610.22367
  26. 26Quantum error correction well below the color code thresholdAli Lavasani et al. (Quantinuum), arXiv-Preprint 2610.24077October 16, 2026arxiv.org/abs/2610.24077
  27. 27Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbindenNiederländische Regierung (federführend Ministerie van Economische Zaken en Klimaat, mit acht weiteren Ministerien), Tweede Kamer der Staten-Generaal, Dokument 2026D48409October 5, 2026www.tweedekamer.nl/downloads/document?id=2026D48409
  28. 28Quantum High Performance Computing Validation and Verification Testbed (DOE National Laboratory Program Announcement LAB 26-3603)U.S. Department of Energy, Office of Science, Advanced Scientific Computing Research (ASCR)September 17, 2026science.osti.gov/-/media/grants/pdf/lab-announcements/2026/LAB-26-3603.pdf
  29. 29Below-threshold execution of fault-tolerant ripple-carry addition on a trapped-ion quantum computerJacob S. Nelson, Andrew J. Landahl, Andrew D. Baczewski (University of New Mexico, Sandia National Laboratories), arXiv-Preprint 2610.14202October 9, 2026arxiv.org/abs/2610.14202
  30. 30Entangled logical qubits on a superconducting quantum processorRobin Harper, Xanda C. Kolesnikow, Campbell K. McLauchlan, Georgia M. Nixon, Stephen D. Bartlett (University of Sydney), Benjamin J. Brown (IBM Quantum), arXiv-Preprint 2610.32347October 23, 2026arxiv.org/abs/2610.32347
  31. 31Meter-scale quantum interconnects between large quantum processorsNeereja M. Sundaresan et al. (IBM Research), arXiv-Preprint 2610.29986October 21, 2026arxiv.org/abs/2610.29986
  32. 32Streaming Regev’s Quantum Factoring AlgorithmKatherine Van Kirk, Craig Gidney (Google Quantum AI, Harvard), arXiv-Preprint 2610.06733October 5, 2026arxiv.org/abs/2610.06733
  33. 33Standard estimators cannot represent fault-tolerant workloads at measured error rates: evaluated, evidence-based uncertainty for quantum resource estimationFurqan Nasir, Sher Jeel Ahmad (FAST-NUCES Islamabad, City University of Science and Information Technology Peshawar, University of Engineering and Technology Peshawar), arXiv-Preprint 2610.10490October 7, 2026arxiv.org/abs/2610.10490
  34. 34Modular Neural Decoder for Surface Code Memory and Logic on Superconducting ProcessorsMoritz Lange, Ole Fjeldså, Gustaf Jonasson Johansson, Mats Granath (Universität Göteborg, Chalmers University of Technology), arXiv-Preprint 2610.03869October 2, 2026arxiv.org/abs/2610.03869
  35. 35Large Language Model-Guided Discovery of Weight-Five Bivariate Bicycle CodesJuan Cruz-Benito (IBM Research), arXiv-Preprint 2610.06623October 5, 2026arxiv.org/abs/2610.06623
  36. 36Agent-assisted experimental strategy transfer across quantum processorsShi-Yao Hou, Zipeng Wu, Chao Zhang, Guanru Feng, Keren Li, Jingen Xiang (Sichuan Normal University, Shenzhen SpinQ Technology, Shenzhen University), arXiv-Preprint 2610.21047October 15, 2026arxiv.org/abs/2610.21047
  37. 37A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem (IACR ePrint 2026/1591)Daniel R. Simon (Amazon Web Services), IACR Cryptology ePrint ArchiveAugust 3, 2026eprint.iacr.org/2026/1591
  38. 38The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP (IACR ePrint 2026/1693)Aparna Gupte (MIT), Seyoon Ragavan (Google, MIT), Mark Zhandry (Google, Stanford University), IACR Cryptology ePrint ArchiveAugust 15, 2026eprint.iacr.org/2026/1693
  39. 39Demonstration of Logical Error Suppression in a Surface Code Memory on a Cloud-Accessible IBM Superconducting ProcessorShuwen Kan et al. (Pacific Northwest National Laboratory, Fordham University, University of Washington, NASA Ames), arXiv-Preprint 2610.23840October 16, 2026arxiv.org/abs/2610.23840
Authors, reuse basis and rights records
  1. 1Anthropic Frontier Red Team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis) · Reuse basis: Text all rights reserved (© Anthropic PBC); the reproduction code published on the page is CC0 1.0. Our own factual paraphrase and link only, no text or code reproduced; the seeds were recomputed with our own implementation · Rights and license record
  2. 2Yiming Gao, Xuyuan Han, Honggang Hu, arXiv-Preprint 2610.11254 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no formulas, figures or tables reproduced. The same work was submitted to IACR ePrint as 2026/2386 on 6 October 2026 · Rights and license record
  3. 3Bundesamt für Sicherheit in der Informationstechnik (BSI) · Reuse basis: All rights reserved; we link to the BSI web page of the notice, which section IV of the BSI terms of use permits without prior consent. No link to the PDF download, because under section IV together with section II links to downloads require consent for commercial or journalistic use; only the statements on this web page are used, as our own factual paraphrase without reproducing text or the document. Page dated 1 October 2026 · Rights and license record
  4. 4Youheng Lü, Lorenz Hetterich, Riccardo Zanotto, Cas Cremers, Michael Schwarz, Lukas Gerlach, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no figures or tables reproduced. Per the ePrint history submitted 8 October 2026, released 11 October 2026 · Rights and license record
  5. 5Linus Backlund, Elena Dubrova, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no figures or tables reproduced · Rights and license record
  6. 6Markku-Juhani O. Saarinen, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no figures or tables reproduced. Per the ePrint history submitted 29 September 2026, released 30 September 2026 · Rights and license record
  7. 7National Cyber Security Centre (NCSC), Vereinigtes Königreich · Reuse basis: Crown copyright; under the NCSC terms reuse is permitted under the Open Government Licence v3.0 with attribution (logos and third-party images excluded); we use only our own paraphrase and a link · Rights and license record
  8. 8Falko Strenzke, IACR Cryptology ePrint Archive · Reuse basis: CC BY-SA 4.0 per the ePrint entry; our own paraphrase and link only, no text, figures or tables reproduced. Submitted 1 October 2026, revised 8 October 2026 · Rights and license record
  9. 9Vahid Jahandideh, Lejla Batina, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no figures or tables reproduced. Submitted 12 October 2026, released 14 October 2026 · Rights and license record
  10. 10Rafael Carrera Rodriguez, Jad Zahreddine, André Monthieu, Aurélien Vasselle, Pierre-Yvan Liardet, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no figures or tables reproduced. Submitted 21 October 2026, released 24 October 2026 · Rights and license record
  11. 11Bhabani Sankar Das, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 27 September 2026, released 30 September 2026 · Rights and license record
  12. 12Massimo Ostuzzi, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 28 September 2026, released 30 September 2026 · Rights and license record
  13. 13Falko Strenzke, IACR Cryptology ePrint Archive · Reuse basis: CC BY-SA 4.0 per the ePrint entry; our own paraphrase and link only, no text or tables reproduced. Submitted 25 October 2026, released 26 October 2026 · Rights and license record
  14. 14Quentin Lavit, Julien Seinturier, Pascal Véron, IACR Cryptology ePrint Archive · Reuse basis: CC BY-NC 4.0 per the ePrint entry; no commercial reuse of the work, therefore only our own brief factual paraphrase and link. Submitted 19 October 2026, released 20 October 2026; per the entry intended for the 20th IMA International Conference on Cryptography and Coding (15 and 16 December 2026) · Rights and license record
  15. 15OpenAI · Reuse basis: Apache License 2.0 per the repository LICENSE file; we use only our own paraphrase and a link, no text or formulas reproduced. Manuscript dated 2 October 2026; first public archive capture of the repository on 6 October 2026, earlier captures returned HTTP 404 · Rights and license record
  16. 16Yiming Gao, Honggang Hu, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no formulas reproduced. Submitted 24 October 2026, released 26 October 2026 · Rights and license record
  17. 17Maor Ben Shahar, Jonathan Morag, Dirk Englund, Kfir Sulimany (MIT), arXiv-Preprint 2610.17286 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures, tables or Lean code reproduced · Rights and license record
  18. 18Jiaxiang Liu, Kuang-Lin Pan, Xiaomu Shi, Ming-Hsien Tsai, Bow-Yaw Wang, Bo-Yin Yang, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 2 October 2026, released 4 October 2026 · Rights and license record
  19. 19Sven Freud, Lennart Hein, Dominik Klein, IACR Cryptology ePrint Archive · Reuse basis: CC BY-NC-ND 4.0 per the ePrint entry; no adaptation and no commercial use of the work, therefore only our own brief factual paraphrase and link. Submitted 21 October 2026, released 24 October 2026; per the entry an extended version of the paper presented on 5 August 2026 at the CSR HACS workshop (IEEE CSR) · Rights and license record
  20. 20Elena Dubrova, Sönke Jendral, Linus Backlund, Mats Näslund, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 14 October 2026, released 15 October 2026 · Rights and license record
  21. 21Markku-Juhani O. Saarinen, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. First version submitted 22 August 2026, third revision 13 October 2026; per the entry published at NORDSEC 2026 (LNCS, to appear), with the ePrint version marked as a minor revision · Rights and license record
  22. 22Giuseppe Vitto, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 24 October 2026, revised 26 October 2026 · Rights and license record
  23. 23Adam Buran, Kevin Nguyen, IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted and released 14 October 2026 · Rights and license record
  24. 24Ramses Fernandez, arXiv-Preprint 2610.31196 · Reuse basis: CC BY-NC-ND 4.0; no adaptation and no commercial use of the work, therefore only our own brief factual paraphrase and link · Rights and license record
  25. 25Andi Gu, Alek H. Kemeny, Susanne F. Yelin, Mikhail D. Lukin (Harvard University, Anthropic, QuEra Computing), arXiv-Preprint 2610.22367 · Reuse basis: CC BY-NC-SA 4.0; no commercial reuse of the work, therefore our own brief factual paraphrase and link only, no figures, tables or circuits reproduced · Rights and license record
  26. 26Ali Lavasani et al. (Quantinuum), arXiv-Preprint 2610.24077 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures or tables reproduced · Rights and license record
  27. 27Niederländische Regierung (federführend Ministerie van Economische Zaken en Klimaat, mit acht weiteren Ministerien), Tweede Kamer der Staten-Generaal, Dokument 2026D48409 · Reuse basis: Government document published via the Tweede Kamer; according to its colophon, text on the site may be used by third parties with attribution (Tweede Kamer) unless stated otherwise; we use only our own paraphrase and a link. Registered on 5 October 2026 as an annex to a letter to parliament according to the Tweede Kamer open-data metadata · Rights and license record
  28. 28U.S. Department of Energy, Office of Science, Advanced Scientific Computing Research (ASCR) · Reuse basis: Public-domain work of the U.S. federal government (17 U.S.C. § 105); our own paraphrase and link · Rights and license record
  29. 29Jacob S. Nelson, Andrew J. Landahl, Andrew D. Baczewski (University of New Mexico, Sandia National Laboratories), arXiv-Preprint 2610.14202 · Reuse basis: arXiv standard licence (non-exclusive distribution licence to arXiv); all other rights remain with the authors, therefore only our own factual paraphrase and link, no figures or tables · Rights and license record
  30. 30Robin Harper, Xanda C. Kolesnikow, Campbell K. McLauchlan, Georgia M. Nixon, Stephen D. Bartlett (University of Sydney), Benjamin J. Brown (IBM Quantum), arXiv-Preprint 2610.32347 · Reuse basis: arXiv standard licence (non-exclusive distribution licence to arXiv); all other rights remain with the authors, therefore only our own factual paraphrase and link, no figures or tables · Rights and license record
  31. 31Neereja M. Sundaresan et al. (IBM Research), arXiv-Preprint 2610.29986 · Reuse basis: arXiv standard licence (non-exclusive distribution licence to arXiv); all other rights remain with the authors, therefore only our own factual paraphrase and link, no figures or tables · Rights and license record
  32. 32Katherine Van Kirk, Craig Gidney (Google Quantum AI, Harvard), arXiv-Preprint 2610.06733 · Reuse basis: arXiv standard licence (non-exclusive distribution licence to arXiv); all other rights remain with the authors, therefore only our own factual paraphrase and link, no figures or tables · Rights and license record
  33. 33Furqan Nasir, Sher Jeel Ahmad (FAST-NUCES Islamabad, City University of Science and Information Technology Peshawar, University of Engineering and Technology Peshawar), arXiv-Preprint 2610.10490 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures or tables reproduced · Rights and license record
  34. 34Moritz Lange, Ole Fjeldså, Gustaf Jonasson Johansson, Mats Granath (Universität Göteborg, Chalmers University of Technology), arXiv-Preprint 2610.03869 · Reuse basis: arXiv standard licence (non-exclusive distribution licence to arXiv); all other rights remain with the authors, therefore only our own factual paraphrase and link, no figures or tables · Rights and license record
  35. 35Juan Cruz-Benito (IBM Research), arXiv-Preprint 2610.06623 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures or tables reproduced · Rights and license record
  36. 36Shi-Yao Hou, Zipeng Wu, Chao Zhang, Guanru Feng, Keren Li, Jingen Xiang (Sichuan Normal University, Shenzhen SpinQ Technology, Shenzhen University), arXiv-Preprint 2610.21047 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures or tables reproduced · Rights and license record
  37. 37Daniel R. Simon (Amazon Web Services), IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only. Submitted 3 August 2026, sixth and last revision 8 October 2026 · Rights and license record
  38. 38Aparna Gupte (MIT), Seyoon Ragavan (Google, MIT), Mark Zhandry (Google, Stanford University), IACR Cryptology ePrint Archive · Reuse basis: CC BY 4.0 per the ePrint entry; our own paraphrase and link only, no code reproduced. Submitted 15 August 2026, revised 1 September 2026 · Rights and license record
  39. 39Shuwen Kan et al. (Pacific Northwest National Laboratory, Fordham University, University of Washington, NASA Ames), arXiv-Preprint 2610.23840 · Reuse basis: CC BY 4.0; our own paraphrase and link only, no figures or tables reproduced · Rights and license record

How to cite

qasb Research (2026). Cryptography and quantum: weaknesses mainly in implementations. Topic report 10/2026, data cutoff October 26, 2026. https://www.qasb.ai/en/reports/2026-10-krypto-quanten

Appendix

For every statement: evidence type, change status, scope and limitations, and the observation period, source value, comparison and uncertainty where the source gives them. The texts are the approved entries of the edition, as is its summary.

Scope and limitations of all 36 statements (A1–A36)

Edition summary

In October 2026 AI appeared in cryptography mainly as a tool for proofs and attack ideas: for the seeds of the NIST curves, for asymptotic lattice algorithms, for a Lean proof of BB84 and for a proof about the matrix multiplication exponent that OpenAI claims but that has not been peer reviewed; none of these results breaks a deployed scheme. The BSI advises against new use of Classic McEliece for the time being, and the NCSC recommends hybrid post-quantum key agreement for TLS 1.3; concrete weakenings mainly concern implementations and deployment environments (a masked Kyber implementation, SLH-DSA, MILENAGE, TPM-based disk encryption, RSA key exchange in legacy TLS configurations). A break of Bitcoin, full AES or the ML-KEM, ML-DSA and SLH-DSA standards is not evidenced; many results are preprints without peer review and could only be checked on their abstracts.

October 2026 brought progress on building blocks, not on attacks: Quantinuum showed error correction well below threshold, Sandia ran encoded adders on the same hardware, IBM processors achieved entangled logical qubits and measurable but weak error suppression, IBM linked two processors over a metre-scale distance, and a leaner variant of Regev’s factoring algorithm still needs more qubits than the leading implementations of Shor’s algorithm. AI assistance is shown for sub-tasks such as circuit design with Claude Mythos 5, code search, decoding and the calibration of very small devices; the Netherlands set migration deadlines for its central administration up to the end of 2030 and 2035, and in September the United States announced funding for validation tools for fault-tolerant computers. There is no evidence of a cryptographically relevant quantum computer or of a quantum attack on deployed schemes; a claimed quantum algorithm against lattice problems is openly disputed, and according to an uncertainty analysis common resource estimates are too narrow.

  1. A1Back to chapter 2.0

    Evidence: observed · baseline · Sources 3, 24

    Scope
    The BSI’s notice on its web page on the 2026 cryptanalysis results, with reference to the recommendations of TR-02102-1. A review of 22 October 2026 puts the conditional key-recovery estimates at about 2^89 to 2^128 per run of a large sparse linear-algebra computation, depending on the parameter set and the cost model.
    Limitations
    Preliminary assessment; the BSI continues to analyse the results and considers further improvements of the attacks conceivable and to be expected. Only the web page of the notice was used, not the PDF offered there (BSI terms of use for downloads). The review (single author, not peer reviewed, checked on its abstract only) finds that none of the structural attacks has been demonstrated as an attack, because the heuristics were only tested on far smaller instances, and that cost models for the same computation differ by about 30 bits. Neither source mentions any AI involvement.
    Observation period
    Notice of 1 October 2026 on results from 2026; review of 22 October 2026 on results of the last two years
    AI relationship
    not demonstrated

  2. A2Back to chapter 2.0

    Evidence: observed · baseline · Source 27

    Scope
    Rijksbrede Quantumstrategie of nine ministries led by the Ministry of Economic Affairs; it follows the EU roadmap and expects a quantum computer able to break today’s, mainly asymmetric, cryptography between 2029 and 2035; the AIVD and RDI advise preparing for such a machine as early as around 2030. By the end of 2026 agencies are to include quantum risk in their risk management.
    Limitations
    Target dates for central-government bodies, not a law; deviations are possible, for example because of sectoral rules or NATO requirements. Resources are to be found within the ministries’ existing budgets, otherwise the ambitions will be adjusted. The expectation about when such a computer may exist rests on international assessments, not on own measurements. Progress reports to parliament are planned only from 2027; AI is not a topic of the cited sections.
    Observation period
    Published and sent to parliament on 5 October 2026
    AI relationship
    not assessed

  3. A3Back to chapter 2.0

    Evidence: observed · baseline · Source 7

    Scope
    Guidance "Using TLS to protect data" for system administrators in organisations and the public sector; the hybrid schemes are rated suitable for personal, enterprise and OFFICIAL-tier government information. Users of TLS 1.2 should plan the move to TLS 1.3 so that they can adopt post-quantum cryptography.
    Limitations
    A recommendation, not a measurement of uptake. The guidance was first published on 21 July 2021 (version 1.1 last reviewed on 10 December 2025) and is therefore marked as an older source; the concrete post-quantum profiles are new in version 1.2. Post-quantum authentication (signatures and certificates) is not yet standardised for TLS and the Web PKI and is therefore not covered; until then ECDSA and RSA remain recommended. RFC 10024 itself was published in August 2026. The guidance does not address AI.
    Observation period
    Guidance first published 21 July 2021; version 1.2 with the post-quantum recommendations published 15 October 2026 (modified 16 October 2026)
    AI relationship
    not assessed

  4. A4Back to chapter 2.0

    Evidence: observed · baseline · Source 28

    Scope
    Announcement LAB 26-3603 of the Advanced Scientific Computing Research programme for national laboratories; one or two projects with USD 7 to 15 million per year over three years; hardware research and development is out of scope unless essential for the tools; results may feed into the Genesis Mission platform.
    Limitations
    A statement of intent subject to future appropriations; awards and results are pending (proposals due 10 November 2026). A larger competition for companies announced at the same time could not be checked as an original solicitation and is not part of this finding. Published in September 2026.
    Observation period
    Announcement of 17 September 2026; proposal deadline 10 November 2026
    Source value
    45 USD million planned total funding
    Baseline
    USD 14 million in fiscal year 2026
    Comparison
    USD 31 million in later years; one or two projects with USD 7 to 15 million per year over three years
    Uncertainty
    Subject to future appropriations; no statistical uncertainty
    AI relationship
    not assessed

  5. A5Back to chapter 3.0

    Evidence: observed · baseline · Source 4

    Scope
    TLS connections with RSA key exchange and 2048-bit keys against a standards-conforming padding oracle; overall success rate 84.8%; demonstration of tampering with software updates by an on-path attacker.
    Limitations
    Requires servers and clients that still allow RSA key exchange for compatibility; per the abstract, modern browsers prefer TLS 1.3. According to the ePrint entry published at NDSS 2027; we found no NDSS 2027 list of accepted papers, so the peer-review status is not independently confirmed. Only the abstract was checked because the full text was blocked by bot protection on 26 October 2026, so AI involvement was not assessed either.
    Observation period
    Preprint submitted 8 October 2026, released 11 October 2026; measurement period not stated in the abstract
    AI relationship
    not assessed

  6. A6Back to chapter 3.0

    Evidence: observed · baseline · Source 19

    Scope
    Discrete TPM chips on the SPI bus, studied on a mini PC and a notebook; additionally a prototype active attack on firmware TPMs in a virtualised QEMU environment that targets the UEFI firmware rather than the bus communication.
    Limitations
    Requires physical access to the device; the firmware-TPM attack is a prototype in a virtual environment. The authors see remedies mainly at specification level. According to the entry the core results were already presented on 5 August 2026 at the CSR HACS workshop in Lisbon; the ePrint version is a substantially extended version. Only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Workshop paper presented on 5 August 2026; extended version submitted 21 October 2026, published 24 October 2026
    AI relationship
    not assessed

  7. A7Back to chapter 3.0

    Evidence: observed · baseline · Source 11

    Scope
    Analysis with a proof under a regularity assumption and a demonstration on all three ML-KEM parameter sets against a simulated incomplete check built on the Python implementation kyber-py; a skipped conditional move even yields a complete plaintext-checking oracle.
    Limitations
    Key recovery was shown against a simulation, not against the named libraries themselves; the abstract does not say whether and when the bugs were fixed. Concerns implementations, not the FIPS 203 standard. Single-author preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026. Published in September 2026.
    Observation period
    Preprint submitted 27 September 2026, released 30 September 2026
    AI relationship
    not assessed

  8. A8Back to chapter 3.0

    Evidence: observed · baseline · Source 20

    Scope
    Profiled side-channel attack on the first AES-128 computation of MILENAGE; neural networks predict probability distributions of the S-box outputs over several rounds; the authors propose a countermeasure with per-device masked round keys that defeated the attack in all tests.
    Limitations
    Requires physical measurement access and profiling; the abstract does not say whether real cards or a laboratory implementation were measured. Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 14 October 2026, released 15 October 2026
    Source value
    93.8% successful recoveries of K and OPc from a single trace (hybrid method)
    Baseline
    Belief propagation alone (SASCA): 87.7%; SAT solver alone (ASCA): 34% with a one-hour timeout
    Comparison
    Hybrid combination in which belief propagation refines the neural-network predictions before the SAT solver
    Uncertainty
    No uncertainty reported in the abstract
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the abstract neural networks provide the probability distributions of the S-box outputs on which both solvers build; the gain over the individual methods comes from combining them. Classical machine learning, not a language model.

  9. A9Back to chapter 3.0

    Evidence: observed · baseline · Source 5

    Scope
    The attack targets secret-key unpacking in an optimised implementation; analysis with a Gaussian mixture model and error correction via information-set decoding.
    Limitations
    Implementation attack requiring physical measurement access to the device, not a break of the ML-DSA standard (FIPS 204); the abstract does not say whether protected, e.g. masked, implementations are equally vulnerable. Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026. For the same reason, AI involvement was not assessed.
    Observation period
    Preprint of 26 October 2026
    Source value
    99% successful key recoveries from a single trace
    Baseline
    Optimised ML-DSA-65 implementation on ARM Cortex-M4
    Comparison
    With an enumeration budget of 2^70 operations in Z_q; no comparison with protected implementations
    Uncertainty
    No uncertainty reported in the abstract
    AI relationship
    not assessed

  10. A10Back to chapter 3.0

    Evidence: observed · baseline · Source 9

    Scope
    Profiled side-channel attack: a neural network estimates the Hamming-weight distributions of both mask shares, a belief-propagation solver accumulates the likelihoods over many traces and recovers all 1,536 secret and error coefficients without lattice reduction.
    Limitations
    Implementation attack requiring physical measurement access and prior profiling, not a break of the ML-KEM standard (FIPS 203). Under the evaluated leakage model masking strongly weakens the leakage but does not protect at this number of traces; higher masking orders are not covered. Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 12 October 2026, released 14 October 2026
    Source value
    2,200 power traces until full key recovery (approximately)
    Baseline
    First-order masked Kyber768 implementation on ARM Cortex-M4, valid ciphertexts only
    Comparison
    At 2,000 traces the derived hints only lower the estimated BKZ block size from 624 to 505; a lattice attack remains impractical there
    Uncertainty
    No uncertainty reported in the abstract
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the abstract a profiled neural network estimates the leakage distributions of the two shares; the authors attribute the decisive step to the belief-propagation solver. This is classical machine learning, not a language model; the network’s share of the success is not quantified in the abstract.

  11. A11Back to chapter 3.0

    Evidence: observed · baseline · Source 10

    Scope
    All parameter sets of SLH-DSA-SHAKE (FIPS 205); the attack targets the pseudorandom function used in signing; experiments in simulation and on a 32-bit microcontroller.
    Limitations
    Implementation attack requiring measurement access to the device, not a break of the SLH-DSA standard; protected implementations and the SHA-2 variants are not covered. Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 21 October 2026, released 24 October 2026
    AI relationship
    not assessed

  12. A12Back to chapter 3.0

    Evidence: observed · baseline · Source 8

    Scope
    The "multiple cryptographic algorithms" mechanism of the 2019 edition of X.509; attack model with a sub-CA and an end-entity certificate; three relying-party policies proposed as mitigation; additionally formal violations of EUF-CMA security and undefined details in the specification.
    Limitations
    The attack requires a quantum computer that breaks traditional signatures and cannot be carried out today. Other hybrid certificate formats such as composite signatures are not covered. Single-author preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 1 October 2026, revised 8 October 2026
    AI relationship
    not assessed

  13. A13Back to chapter 3.0

    Evidence: observed · baseline · Source 18

    Scope
    Gao–Mateer and Frobenius FFTs; the CryptoLine tool was extended with vector syntax; a Chinese-remainder decomposition turns a problem with more than 2^14 independent bit variables per multiplicand into local checks that computer algebra systems such as Singular can solve.
    Limitations
    Verifies the functional correctness of specific routines, not the security of the overall scheme or freedom from side channels. The BSI currently advises against new use of Classic McEliece (see the BSI finding). Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026, so AI involvement was not assessed.
    Observation period
    Preprint submitted 2 October 2026, released 4 October 2026
    AI relationship
    not assessed

  14. A14Back to chapter 4.0

    Evidence: open · baseline · Source 2

    Scope
    Asymptotic analysis for polynomial moduli and polylogarithmic coefficient scales; running times of order 2^((1/2+o(1))·n/ln ln n) for the LWE-type families; builds on a framework by Ducas, Engelberts and Loyer (CRYPTO 2025).
    Limitations
    Asymptotic result for growing parameter families, not for the standardised parameter sets; preprint without peer review, and the proofs have not been checked independently. Further similar preprints appeared in October and are not summarised here. No evidence of a practical threat to ML-KEM or ML-DSA.
    Observation period
    Preprint of 8 October 2026 (submitted as ePrint 2026/2386 on 6 October 2026)
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    The paper’s AI disclosure names language-model tools via Codex (GPT-5.6-sol, GPT-6-astra): they proposed ideas and derivations and helped draft the manuscript; the authors checked and take responsibility for all claims. The share of AI in the result is not quantified.

  15. A15Back to chapter 4.0

    Evidence: observed · baseline · Source 6

    Scope
    First round of the next-generation commercial cryptographic algorithms programme of the Chinese Institute of Commercial Cryptography Standards: 34 signature schemes, 41 key encapsulation mechanisms, 9 key exchange protocols, 35 hash functions; findings include universal forgeries, key recovery and trivial hash collisions.
    Limitations
    The author’s count from public sources he harvested, rated with his own ruleset; early AI-assisted findings mostly concerned implementations. Concerns new competition candidates, not deployed standards such as ML-KEM or ML-DSA. Not peer reviewed; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026. Published in September 2026, so included only as a supplement.
    Observation period
    First competition week from 20 September 2026; preprint of 30 September 2026
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    The author describes an agentic workflow with which his evaluation effort discovered, verified and disclosed 110 of the findings (47 critical); some outside researchers also worked with AI assistance. No independent check of the count is available.

  16. A16Back to chapter 4.0

    Evidence: observed · baseline · Source 21

    Scope
    Variant of the higher-order vanishing attack (Hemmert and Wiemers, CRYPTO 2026) that replaces a costly search phase with a fast linear-algebra step; experiments with public data only.
    Limitations
    According to the author HOVER does not threaten the Classic McEliece parameter sets in its present form; the challenges are far smaller than deployed keys. Only the author describes the discovery process with the language model, and the abstract does not name the model; whether this statement was already in the first version could not be checked. Per the ePrint entry published at NORDSEC 2026 (proceedings still to appear); only the abstract was checked because the full text was blocked by bot protection on 26 October 2026. First version from August 2026, therefore context only.
    Observation period
    First version submitted 22 August 2026, third revision 13 October 2026
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    The author writes in the abstract that HOVER’s main cryptanalytic shortcut was discovered with a large language model; the abstract gives neither details nor the model, and no independent confirmation of the process is available.

  17. A17Back to chapter 4.0

    Evidence: observed · baseline · Source 14

    Scope
    Study with saliency maps and attention visualisation; after removing the artefact (low-weight rows in the random instances) accuracy remains significant; a simple pairwise-XOR rule over rows predicts largely the same as the model; on random matrices with matching distance and XOR properties the model loses most of its predictive power.
    Limitations
    Concerns one specific AI tool and distinguishing only, not key recovery; other AI approaches are not ruled out. Per the ePrint entry intended for the 20th IMA International Conference on Cryptography and Coding, which takes place on 15 and 16 December 2026; we have not independently confirmed the peer review. Only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Submitted 19 October 2026, released 20 October 2026
    AI relationship
    not demonstrated

  18. A18Back to chapter 4.0

    Evidence: open · baseline · Sources 15, 16

    Scope
    OpenAI repository with 719 manuscripts; according to the repository most results were obtained with an unreleased internal model using on average three hours of compute per result; according to the repository the bound ω ≤ 9/4 is formalised in Lean (not checked by us). The follow-up by Gao and Hu concerns heuristic sieving following the BDGL analysis under the spherical heuristic.
    Limitations
    Vendor claim without peer review: OpenAI itself warns that unformalised results may contain errors and withdrew three other manuscripts on 7 October; we have no independent confirmation of the proof or its Lean formalisation. The sieving speed-up requires an exponent strictly below 9/4, which the OpenAI result does not provide either; no concrete weakening of ML-KEM or ML-DSA is shown. The matrix proof concerns arithmetic complexity, not practically usable matrix sizes. The follow-up was checked on its abstract only because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    OpenAI manuscript dated 2 October 2026, public since 6 October 2026; follow-up submitted 24 October 2026, published 26 October 2026
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the repository the vast majority of results were obtained with the same procedure and an unreleased internal OpenAI model; OpenAI names only two other works as exceptions, and the manuscript lists OpenAI as author. Only OpenAI itself documents the production process (conflict of interest). Whether the lattice-sieving follow-up used AI is not stated in its abstract.

  19. A19Back to chapter 4.0

    Evidence: model estimate · baseline · Source 13

    Scope
    Herding technique after Kelsey and Kohno that pools signatures across any number of keys; even the first signature of a key therefore contributes to the exposure of a whole ecosystem. According to the author, the SHAKE256 parameter sets are not affected.
    Limitations
    A computational cost estimate far beyond practical feasibility, no executed attack. Single-author preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 25 October 2026, published 26 October 2026
    AI relationship
    not assessed

  20. A20Back to chapter 4.0

    Evidence: model estimate · baseline · Source 12

    Scope
    Combines a geometric observation about the whipping transformation with the pseudo-oil attack and a multi-target reduction; for the second-round parameters the estimate for levels I and III drops by about 18 and 16 bits, and level I misses its target by 15 bits there.
    Limitations
    Cost estimates, no executed attack and no practical threat; MAYO is a candidate, not a standard. Single-author preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026. Published in September 2026.
    Observation period
    Preprint submitted 28 September 2026, released 30 September 2026
    AI relationship
    not assessed

  21. A21Back to chapter 4.0

    Evidence: model estimate · baseline · Source 23

    Scope
    An expected 2^60.9 iterations as the benchmark; according to the authors the speed-up comes solely from representation, arithmetic and memory layout, not from a new algorithm; measurements on one RTX PRO 6000 Blackwell; one campaign walked 2^56.68 iterations, 5.4% of the expected work.
    Limitations
    A projection from measured iteration rates, not a solved challenge. For the deployed curve NIST P-256 the same levers give only 1.52 times (1.632 billion iterations per second) according to the abstract, which still leaves P-256 about 6·10^21 card-years away, and according to the authors the generic bound is not beaten. The gains depend on the GPU model. Preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint of 14 October 2026
    Source value
    14.64 billion Pollard rho iterations per second on one RTX PRO 6000 Blackwell
    Baseline
    Bitsliced control build: 0.85 billion iterations per second
    Comparison
    17.2-fold increase in the audited campaign build; a later build reaches 15.88
    Uncertainty
    No uncertainty reported in the abstract
    AI relationship
    not assessed

  22. A22Back to chapter 4.0

    Evidence: observed · baseline · Source 22

    Scope
    Certificates based on elliptic curves constructed with complex multiplication; a norm-lattice reconstruction factors the modulus in expected polynomial time when the Frobenius lies in a known imaginary quadratic field or has trace zero; proposed repairs are also broken under the stated assumptions.
    Limitations
    Concerns proposed certificate schemes and publicly posed example numbers, not ordinary RSA key generation. According to the author it remains open whether a secure public certificate of this kind can be produced efficiently. Single-author preprint without peer review; only the abstract was checked because the full text was blocked by bot protection on 26 October 2026.
    Observation period
    Preprint submitted 24 October 2026, revised 26 October 2026
    AI relationship
    not assessed

  23. A23Back to chapter 5.0

    Evidence: observed · baseline · Source 26

    Scope
    Memory experiments with 20 syndrome rounds each; at distance 7, 29,000 runs with three logical errors (main decoder Tesseract); additionally encoded two-qubit benchmarks and two neural decoders (CNN and transformer) trained only on emulator data, which reached similar values at distance 7 but smaller suppression factors overall (7 and 8).
    Limitations
    Manufacturer’s study (conflict of interest), not peer reviewed. The best value rests on three failures and has a wide uncertainty interval; it comes from a memory experiment without a useful computation, far from the scale needed to attack today’s cryptography. All decoders ran offline; the best values come from the algorithmic decoder Tesseract, and the neural decoders did not improve on them.
    Observation period
    Preprint of 16 October 2026; measurement period not stated
    Source value
    0.000005 logical error rate per syndrome round at colour-code distance 7 (memory experiment)
    Baseline
    Distance 5: 3.8·10^-5; distance 3: 5.5·10^-4 (same decoder, Table 1 of the source)
    Comparison
    Suppression factor per distance step Λ = 12 (+3/−2)
    Uncertainty
    1σ Wilson interval 3·10^-6 to 9·10^-6; three logical errors in 29,000 runs of 20 rounds each
    AI relationship
    not demonstrated

  24. A24Back to chapter 5.0

    Evidence: observed · baseline · Source 39

    Scope
    Rotated surface-code memory; optimised syndrome extraction (short readout, fused measurement and reset, echo pulses) lowered the median error per round by factors of 3.8 (X) and 1.4 (Z); experiments of up to 150 rounds.
    Limitations
    In long runs the distance advantage weakens, accompanied by long-lived correlations that may reflect a persistent error component; performance varies with placement on the chip. Suppression factors below 2 are far from what attacks on today’s cryptography would require. Independent users of the cloud hardware with no IBM authors, but a preprint without peer review.
    Observation period
    Preprint of 16 October 2026
    Source value
    1.85 suppression factor of the logical error per round (X memory, maximum-likelihood decoding)
    Baseline
    Protected distance 3: 0.52% logical error per round
    Comparison
    Protected distance 6: 0.22%; Z memory 0.53% to 0.24%, factor 1.68
    Uncertainty
    Fitted interval per the results section: 1.71 to 2.00 (Z memory: 1.68 with 1.57 to 1.81)
    AI relationship
    not demonstrated

  25. A25Back to chapter 5.0

    Evidence: model estimate · baseline · Source 33

    Scope
    A framework that propagates hardware-derived assumptions through five surface-code cost models, with a pre-registered evaluation; the models differ by a stable factor of two, and two widely used estimators (Azure Quantum Resource Estimator, Qualtran) cannot represent 80 to 100% of the realistic parameter space.
    Limitations
    A model calculation, not a measurement of an attack. The error-rate median includes a 30% surcharge set as a modelling assumption; without it the RSA-2048 median lies about 2.9 times above the point estimate and the interval spans a factor of about 23. The analysis relies on older circuit counts (for RSA-2048 the 2021 estimate by Gidney and Ekerå) and a superconducting surface-code architecture; newer, leaner algorithms and other codes are missing. According to the disclosure a language model helped with software, experiments and text. Preprint without peer review.
    Observation period
    Preprint of 7 October 2026
    Source value
    4.6 -fold median of required physical qubits for RSA-2048 relative to the conventional point estimate
    Baseline
    Point estimate of about 2·10^7 physical qubits under the planning assumption of 10^-3
    Comparison
    Median of 1.01·10^8 physical qubits with the error rate derived from hardware data (median about 4·10^-3)
    Uncertainty
    90% interval 2.86·10^7 to 1.18·10^9 physical qubits (factor 41); without the 30% surcharge about 2.9-fold and a factor of 23
    AI relationship
    not demonstrated

  26. A26Back to chapter 5.0

    Evidence: open · baseline · Sources 37, 38

    Scope
    Simon builds on Regev’s reduction; according to his own note, the proof of a lemma in the first version was flawed and has been revised. The rebuttal by Gupte, Ragavan and Zhandry argues that the algorithm does not determine the least significant bit of the secret with non-negligible advantage and aims to rule out a broader class of such algorithms.
    Limitations
    An unresolved dispute between preprints without peer review, with no decision by review or independent checking. A break of ML-KEM or other deployed lattice schemes is not evidenced, and even a correct algorithm would need a large error-corrected quantum computer. Both papers were checked only via the abstracts and notes on the ePrint pages because the full texts sat behind a bot check; we could not check the content of the author’s note. First versions from August 2026, therefore context only.
    Observation period
    First version 3 August 2026, sixth revision 8 October 2026; rebuttal submitted 15 August 2026, revised 1 September 2026
    AI relationship
    not assessed

  27. A27Back to chapter 5.0

    Evidence: observed · baseline · Source 30

    Scope
    Superconducting processor with fast reset; excluding weak qubits and couplers halved the logical error per round at distance 5 from 1.9% to 0.9%; stability experiment over 170 measurement rounds.
    Limitations
    The Bell fidelities rely on post-selection with a usable share of about 40%; one co-author works at IBM (conflict of interest). Logical errors just below 1% per round are far from what attacks on today’s cryptography would require. Preprint without peer review.
    Observation period
    Preprint of 23 October 2026
    AI relationship
    not demonstrated

  28. A28Back to chapter 5.0

    Evidence: observed · baseline · Source 29

    Scope
    Error-detecting [[8,3,2]] and [[4,2,2]] codes with an additional algorithmic check that raises the effective fault distance of many circuit locations from two to four; classical inputs of up to five bits.
    Limitations
    Error detection with discarding of faulty runs rather than error correction: the share of usable runs fell from just over 60% for one bit to about 1% for five bits, and jobs with burst errors were filtered out afterwards. The best value rests on a single failure. Classical inputs only; the work does not target cryptanalysis and is far from the computations that attacks on today’s cryptography would require. Preprint without peer review.
    Observation period
    Preprint of 9 October 2026
    Source value
    0.00006 estimated logical failure rate of one-bit addition (after filtering burst errors)
    Baseline
    Unencoded one-bit addition on the same hardware: (3.5 ± 1.3)·10^-3
    Comparison
    Encoded with [[8,3,2]] and [[4,2,2]] codes plus the algorithmic check
    Uncertainty
    ± 5.9·10^-5; a single observed failure
    AI relationship
    not demonstrated

  29. A29Back to chapter 5.0

    Evidence: observed · baseline · Source 31

    Scope
    Four so-called L-couplers between two modules, each with two tunable auxiliary qubits and two couplers; generation of entangled states across both processors, including two simultaneous Bell pairs.
    Limitations
    Manufacturer’s study (conflict of interest), not peer reviewed. The paper does not show whether these fidelities suffice for error-corrected computation across modules.
    Observation period
    Preprint of 21 October 2026
    Source value
    94.75% mean fidelity of CZ gates between qubits of two modules
    Baseline
    State transfer over the same connections: mean 99.00%
    Comparison
    Best link: 96.42 ± 0.28%
    Uncertainty
    ± 0.28 percentage points for the best link; none given for the mean in the source
    AI relationship
    not demonstrated

  30. A30Back to chapter 5.0

    Evidence: model estimate · baseline · Source 32

    Scope
    Theoretical construction: superposition masking and phase estimation with Fibonacci powers allow the control qubits to be streamed and recycled; the earlier variant by Ragavan and Vaikuntanathan needed 11.32n qubits.
    Limitations
    An asymptotic qubit count, not a full resource estimate with error correction and runtime for RSA-2048; the work does not make Shor’s algorithm cheaper. According to the disclosure the core ideas are human, and AI helped with numerical code and the manuscript. Preprint without peer review.
    Observation period
    Preprint of 5 October 2026
    AI relationship
    not demonstrated

  31. A31Back to chapter 6.0

    Evidence: observed · baseline · Source 1

    Scope
    Seeds of the prime curves in FIPS 186-2 and ANSI X9.62, supplied by the NSA without justification; additionally the base points of six curves generated in 1997. Published with reproduction code.
    Limitations
    Not a cryptographic break and not a new attack; according to Anthropic the finding makes a deliberate backdoor via the seeds much less plausible. Still open: the seed of the binary curve B-163, the base points of P-224, P-256, P-384 and P-521, and why some suitable candidates were skipped. Conflicts of interest: only Anthropic describes the AI-assisted discovery process, which showcases its own model; in addition, the drafts of this report were written with an Anthropic Claude model. We independently checked only the mathematics (our own recomputation of all five seeds).
    Observation period
    Discovery in October 2026, published 16 October 2026; concerns curve generation in 1997/98
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    Anthropic describes that an internal Claude research model found the origin when asked by an employee, without being pointed to the earlier passphrase lead. The mathematics is checkable (our own recomputation on 26 October 2026); the discovery process is not, and Anthropic makes the model.

  32. A32Back to chapter 6.0

    Evidence: observed · baseline · Source 25

    Scope
    Study by researchers at Harvard University, Anthropic and QuEra of eight compilation tasks from numerics, chemistry, optimisation, simulation and number theory; according to the authors, Toffoli and qubit counts fell relative to the best previous circuits in seven tasks. Inversion is the most expensive part of the point addition that Shor’s algorithm for elliptic curves performs repeatedly (28 times in the cited windowed variant).
    Limitations
    A building block, not a complete attack, and a new trade-off between qubit and gate counts rather than an improvement in both: the product of the two is higher than for the construction with 1,446 qubits. Circuit-level qubit counts without error-correction overhead and without physical qubits; no current hardware can run such a computation. Two of the four authors are affiliated with Anthropic, the provider of the model used (conflict of interest); the comparison is with published circuits, not with a search without a language model. No evidence of a threat to Bitcoin or other systems; preprint without peer review.
    Observation period
    Preprint of 15 October 2026
    Source value
    935 qubits (circuit-level peak, without error correction) for a point addition on secp256k1 with the new inversion
    Baseline
    Earlier constructions per Table S3: 1,446 qubits with 1.9 million Toffoli gates and 838 qubits with 70 million Toffoli gates
    Comparison
    New circuit: 4.0 million Toffoli gates; product of Toffoli gates and qubits 3.7·10^9 versus 2.7·10^9 and 5.8·10^10 respectively
    Uncertainty
    No statistical uncertainty; the circuit may fail with probability of at most 2·10^-4 per point addition (four failures in 100,000 tests)
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the methods section, Claude Mythos 5 proposed architectures and program rewrites in an evolutionary search (OpenEvolve) and produced the circuits without substantive human intervention; an independent evaluator tested every circuit, the point addition with 100,000 tests. Two authors are affiliated with Anthropic.

  33. A33Back to chapter 6.0

    Evidence: observed · baseline · Source 17

    Scope
    Formalisation in Lean 4 resting only on Lean’s standard axioms; a dedicated program language enforces local operations and classical communication (LOCC); agents based on Claude and GPT translated statements from papers into Lean, and a locally run GLM-5.3-Flash model wrote some partial results under the direction of Claude Opus 5; the library is open source.
    Limitations
    Concerns quantum key distribution (QKD) in the idealised qubit model, not post-quantum schemes and not practical decoy-state systems. Human review of the definitions remained necessary: it caught, for example, an AI-generated protocol that computed the key from both parties’ data although neither party had access to both. Preprint without peer review; the extent of automation is not quantified.
    Observation period
    Preprint of 12 October 2026
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to Section II the authors developed the formalisation iteratively with language-model agents based on Claude and GPT that translated statements, decomposed proofs and developed supporting results; several formal results were written by an open-weight GLM-5.3-Flash model. The Lean kernel checked every proof; humans reviewed definitions and statements.

  34. A34Back to chapter 6.0

    Evidence: observed · baseline · Source 34

    Scope
    Graph-recurrent network pretrained in simulation and fine-tuned on hardware data; additionally a stability experiment with a variable measurement error rate and a lattice-surgery experiment with two distance-3 patches; training on single GPUs.
    Limitations
    On the IBM device the error per round at distance 5 was higher (2.48%) than at distance 3, so the device was not operating below threshold in this experiment. On the Google data the decoder reached 0.179% at distance 7 versus 0.130% for AlphaQubit. Preprint without peer review.
    Observation period
    Preprint of 2 October 2026
    Source value
    1.47% logical error per round at distance 3 on an IBM Nighthawk processor (neural decoder)
    Baseline
    MWPM on the same measurement data: 2.79%
    Comparison
    Second chip region: 1.26% versus 2.60%; distance 5: 2.48% versus 3.79%
    Uncertainty
    No uncertainty given in Table II
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    The decoder is a neural network; the comparison with the algorithmic MWPM decoder on the same hardware data (Table II) shows its contribution directly. Classical machine learning, not a language model.

  35. A35Back to chapter 6.0

    Evidence: observed · baseline · Source 35

    Scope
    1,142 code proposals, 1,081 of them from language-model programs; certified codes such as [[96,4,10]], [[140,6,10]] and [[180,4,14]]; comparison with a known code archive and with three random searches using the same sampling settings.
    Limitations
    Both approaches comprised 6,444 evaluations each; in the language-model-guided search these yielded only 936 distinct proposals, in the random searches 6,444, which therefore found more connected certified classes (566 to 572 versus 311); the best class certified in the campaign, [[180,4,14]], also appeared in the random searches. Better codes may lower the cost of future error correction but do not show progress in attacks. Single-author preprint without peer review; the author works at IBM, and both language models also helped with the manuscript and the data analysis.
    Observation period
    Preprint of 5 October 2026
    Source value
    87.18% of proposals with positive distance certified at distance 5 or more (language-model-guided search)
    Baseline
    Three random searches: 72.50 to 74.26%
    Comparison
    936 distinct language-model-guided proposals (from 6,444 evaluations) versus 6,444 distinct random proposals each
    Uncertainty
    No uncertainty given; range across three random controls
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the methods, Claude Opus 5 and GPT-5.6 Sol generated the search programs in OpenEvolve campaigns; 1,081 of the 1,142 proposals stem from them. Against three random controls only the higher certified yield is shown, not broader coverage.

  36. A36Back to chapter 6.0

    Evidence: observed · baseline · Source 36

    Scope
    Five three-qubit NMR processors; the agent assessed results, selected the next measurements and adapted procedures, while deterministic tools handled numerical calculations; humans prepared the devices and intervened physically.
    Limitations
    Very small processors of a type that plays no role in cryptanalysis; four of the six authors work for the device maker SpinQ, whose processors were used (the authors declare no competing interests). Humans repeatedly readjusted the instruments, the separation of device contexts was only procedural, and the paper contains no comparison with a purely manual procedure. Preprint without peer review.
    Observation period
    Preprint of 15 October 2026
    AI relationship
    documented by the cited original
    Basis for the AI relationship
    According to the methods the agent coordinated deterministic tools, assessed results and chose the next steps; device preparation and physical interventions remained with humans. The agent’s involvement is shown, not a gain over manual work.

And in your case? Check it with sources.

Start an analysisFor organizations
All reports