Claude's AI streamlines one step of the quantum attack on Bitcoin, without setting a record

Fifty-three hours. That is how long a single session lasted in which Claude Mythos 5, Anthropic's model, proposed, tested and reworked a quantum circuit, with no human intervention between turns. On October 16, Anthropic presented the result on its blog: an elliptic-curve point-addition circuit that would require 17 times fewer gates than a published design, at the cost of 12% more qubits.

Why should security specialists care? Point addition is the basic operation of Shor's algorithm applied to elliptic curves, the one that would let a sufficiently powerful quantum computer recover a private key from the public key. The paper, posted on arXiv on October 15 by Andi Gu, Alek Kemeny and physicists Susanne Yelin and Mikhail Lukin, works on the curve y² = x³ + 7 over a 256-bit prime field. That is the definition of secp256k1, the curve behind Bitcoin signatures.

Seventeen times fewer gates, but compared with what?

The results table in the paper's appendix qualifies the announcement. It compares four circuits:

• Schrottenloher's: 1.9 million Toffoli gates, 1,446 qubits;
• Luo and coauthors', as reconstructed by the authors: 70 million gates, 838 qubits;
• the first circuit found by Claude: 4 million gates, 935 qubits;
• a second circuit found by Claude: 21 million gates, 843 qubits.

The 17x factor is therefore measured against the most qubit-efficient design, Luo's. Against Schrottenloher's, Claude's circuit uses about 35% fewer qubits but twice as many gates, and its combined cost (gates multiplied by qubits) is higher. It is not an absolute record: it is a new trade-off point between two scarce resources. For the seven other problems studied, in chemistry, optimization and simulation, the paper does claim fewer gates and fewer qubits at once.

Circuits that sometimes fail

The paper also points out a limitation: the circuits found are probabilistic. For the first one, the failure probability is estimated at no more than about 1.6 in 10,000 per point addition, against a set budget of 2 in 10,000, and four tests out of 100,000 failed. The computation must then be rerun, which according to the authors costs less than 0.6% extra time. Nothing was run on a real quantum machine: these are resource estimates, checked by an automated evaluator and, for some of the reasoning, by the Lean proof assistant.

Point addition is only one building block. The paper notes that a reference algorithm calls it 28 times. And a fault-tolerant quantum computer also requires error correction and hardware control, which Anthropic acknowledges are separate problems.

What this means for you

Not much in the immediate term, but the signal matters. As with Claude's investigation of the P-256 curves, AI is accelerating research around elliptic-curve cryptography. Quantum resource estimates drop in fits and starts, and each advance on paper brings closer the day the attack becomes realistic. The answer stays the same: inventory your uses of RSA and elliptic curves, and follow the migration timeline described in our October progress report.

It remains to be seen what independent cryptographers will say. They have not yet reacted publicly.