Article — "Google's Secret Quantum Cryptography Work Replicated and Surpassed in Three Days": Two sources tell the same story from opposite ends, and the gap between them is the whole lesson.
Google's own blog, dated March 31, invokes the sacred machinery of vulnerability disclosure: Project Zero, CERT/CC, ISO/IEC 29147:2018. It frames a quantum circuit as a bug to be embargoed, something you conceal so defenders can patch before attackers pounce.
Craig Gidney, the researcher who actually designed the hidden circuits, tells the other end of the story two months later, in a blog post that reads like a confession: "We should just publish openly."
That reversal is the article. It is not a story about a heist getting cracked. It is a story about a threat model that was wrong before anyone touched a keyboard.
Last week in this space we picked apart the DOE's "scientifically relevant" bar and the fault-tolerant timeline it's supposed to gate. This week the quantum thread produces something less abstract: an actual number, converging from three directions, that says the code-breaking clock is running faster than the migration schedule assumes.
Start with what Google published on March 31, because the numbers are the only part everyone agrees on. Two compiled circuits for Shor's algorithm against 256-bit elliptic curve cryptography: one under 1,200 logical qubits and 90 million Toffoli gates, another at 1,450 qubits and 70 million. Executable, per Google, on fewer than 500,000 physical qubits, reportedly cracking the curve in 18 to 23 minutes, per IEEE Spectrum. Roughly a 20-fold reduction in physical qubits from prior estimates.
That is the result Google decided to hide. Not the fact of it—the whitepaper is 57 pages—but the specific circuit construction, sealed behind a zero-knowledge proof that let outsiders verify the qubit and gate counts without seeing how the circuit achieved them.
To my knowledge, per Inria's André Schrottenloher, this was the first time a result of this kind was released with a zero-knowledge proof in quantum cryptanalysis. A genuine first. It was also, per University of Waterloo's David Jao, "both useless and futile"—because the point of research is to convey understanding, and a ZKP conveys none.
Here is why the secrecy was doomed by construction, not by bad luck.
Gidney later admitted the core technique was already sitting in Google's own October 2025 paper on Decoded Quantum Interferometry. That paper introduced an efficient method for space-efficient in-place modular multiplication—and multiplication is the most expensive operation in elliptic curve point addition.
"We knew that all anyone had to do, to unmask our ZKPs, was read over our prior papers and put two and two together," Gidney writes.
Sit with that. Google concealed a theorem whose load-bearing trick they had themselves published five months earlier. This is the categorical error at the heart of the whole exercise: a circuit optimization is not a zero-day.
A circuit optimization is not a zero-day. You cannot embargo a consequence of published mathematics any more than you can embargo the number seven.
A zero-day is a contingent fact about one vendor's code—patchable, ownable, genuinely secret until disclosed. A circuit optimization is a mathematical inevitability. Once the surrounding literature exists, the result is latent in it, waiting for anyone competent to derive. You cannot embargo a consequence of published mathematics any more than you can embargo the number seven.
So the disclosure logic Google reached for—Project Zero, ISO 29147, the whole responsible-disclosure apparatus—was incoherent from the first sentence. That machinery assumes a patchable secret behind a deadline. It has nothing to say about a publishable theorem that your own prior work already implies.
What concealment actually produced was a Streisand effect. Gidney names it directly in the post-mortem: announcing "we have a solution but won't share it" drew far more scrutiny to ECC circuit optimization than open publication ever would. The existence of a solution is itself information—he cites the George Dantzig anecdote, where knowing a problem is solvable removes the hardest part of solving it. And the ZKP conveniently identified exactly who to pressure for the details, which Gidney describes, with characteristic bluntness, as "rubber-hose cryptanalysis."
Then it got worse, from a direction Google apparently did not anticipate.
On April 17, per Trail of Bits, it published its own zero-knowledge proof that beat Google's on every metric. Total operations: 8.3 million against Google's 17 million, per Trail of Bits. Qubits: 1,164 against 1,175, per Trail of Bits. And Toffoli count: zero, against Google's 2.1 and 2.7 million, per Trail of Bits.
Zero Toffoli gates. That is not a quantum breakthrough. It is a lie the verifier accepted.
Trail of Bits did not improve the circuit. They exploited unsafe blocks in the prover's Rust deserializer, combined with a pair of jump-table bugs, to forge a proof that fully verified under Google's unpatched code—cryptographically indistinguishable from a proof of real algorithmic improvement, carrying the same verification key.
This is, reportedly, the second, sharper indictment. A ZKP does not just fail to convey understanding; it shifts trust from mathematics to software implementation quality. Google's scientific claims were never in question and the code was patched. But the episode proves the concealment machinery introduced a brand-new attack surface—one that got forged in two weeks and would not have existed at all under open publication.
Concealment bought Google nothing and created a liability. This is the mirror image of a pattern this newsletter has tracked elsewhere—where in the Tesla thread "disclosing least" genuinely functioned as an advantage; here the inverse holds, because there was no secret to protect and openness would have cost nothing.
Now strip away the drama entirely, because the drama is not the signal. The signal is that the number keeps landing in the same place no matter who reaches for it or how fast.
Eigen Labs reportedly replicated about 80% of it over a weekend, per EigenCloud's founder. A 22-year-old engineer, Gautham Anant, per IEEE Spectrum, analyzed Google's verification virtual machine, built software to score any candidate circuit, then pointed swarms of AI agents at the scientific literature to design and optimize circuits automatically—crowdsourced through a public repository where agents traded notes. To be clear about what these agents are: literature-mining and circuit-optimization software, nothing embodied, nothing physical. They read papers and shuffle gates.
Schrottenloher did it in two months, rigorously, as a EUROCRYPT 2026 paper. His space-optimized secp256k1 circuit reportedly lands at 1,192 logical qubits and about 2.4 million Toffoli gates—matching Google on qubits, beating them slightly on gates. Gidney confirmed the match the same day and congratulated him for improving the Toffoli count.
Look at the convergence. Google's low-qubit circuit: 1,175. Trail of Bits' 1,164, though per Trail of Bits that figure came from a forged proof rather than a genuine circuit result. Schrottenloher: 1,192. The two genuine independent results (Google's 1,175 and Schrottenloher's 1,192) both land near 1,175 to 1,200 logical qubits—and the trend across every reported variant is downward.
That number is the thing to act on. Not the concealment, not the forgery, not the teenagers with agent clusters. The convergence.
Because U.S. federal agencies are required to move high-value and high-impact systems to post-quantum cryptography for key establishment by the end of 2030. That deadline was set against a moving target that keeps moving toward us. Recall that the RSA-2048 estimate already fell 20-fold in a single revision; ECC just did the same.
Which brings back last issue's unresolved question. If the DOE's "scientifically relevant" bar, and the fault-tolerant milestone the 2030 deadline implicitly assumes, are calibrated against yesterday's resource estimates, they are calibrated against numbers that are still dropping.
A deadline is only meaningful relative to a fixed threat. This threat is not fixed. The logical-qubit requirement fell into the ~1,150 range faster than Google could keep it secret—and the largest superconducting processor to date, IBM's Condor, reportedly sits at 1,121 physical qubits, per IEEE Spectrum.
The lesson of the failed ZKP is that you cannot embargo mathematics. The lesson of the converging number is that you cannot embargo the timeline either. Both were always going to arrive on schedule, and the schedule is not ours to set.