Google cuts errors 40-fold in one quantum computing step, but RSA encryption is not at risk

More than nine attempts out of ten are thrown away, and that is by design. On October 15, the journal Science published an experiment by Google's Quantum AI team on its Willow chip. It deals with "magic states," a resource a quantum computer needs for certain operations. According to estimates cited by Google, producing them could take up to 95% of a machine's capacity. The technique tested, called "cultivation," reduced errors by a factor of about 40 compared with uncultivated states.

For a security leader, only one question matters: should you speed up your migration to post-quantum cryptography? The short answer is no. Still, the result is worth understanding, because it affects a step that weighs heavily in the cost of an attack on RSA encryption.

Why are they called "magic" states?

Qubits, the computing units of a quantum computer, are fragile. Error-correcting codes can protect the simplest operations. The others, which any useful computation needs, consume magic states that can only be used once. Since 2004, the reference method, distillation, has relied on dedicated qubit "factories." In 2024, three Google researchers, Craig Gidney, Noah Shutty and Cody Jones, proposed a more economical route: grow an imperfect state in a small area of the chip, check it with successive measurements, and discard every attempt where an error is detected.

Until now, the method had only been tested in theory and in simulation. On Willow, according to the blog post signed by Emma Rosenfeld and Craig Gidney, the resulting states reach a record fidelity of 99.99%. The team also transferred a state from one error-correcting code to a larger one, from a distance-3 color code to a distance-5 surface code, which shows that the purified state can be adapted to a larger encoding. According to the outlet Decrypt, the experiment used at most 54 of Willow's 105 qubits, and only about 8% of attempts passed all the checks.

RSA encryption remains out of reach

That rejection rate is a reminder that the method is probabilistic. Above all, the gap with a real attack remains huge. Again according to Decrypt, factoring an RSA-2048 key would require magic states with an error rate on the order of one in ten billion, roughly a million times better than the result achieved. Google estimates that halving its chip's noise would bring the error down to about two in 100,000, because the error falls with the cube of the noise level. The authors themselves acknowledge that a larger-scale demonstration is still needed.

Even so, cultivation is one of the techniques that have driven estimates down. In 2025, Craig Gidney calculated that an RSA-2048 key could be broken with fewer than one million noisy qubits, twenty times fewer than his 2019 estimate (20 million), but with a computation lasting under a week instead of eight hours. Willow has 105. A step that existed only on paper has just been demonstrated in the lab. As with the Bitcoin attack circuit slimmed down by Claude, it is the estimated cost of the attack that drops, not the attack that becomes possible.

What should you do with this announcement?

It does not upend any timeline, but it confirms the existing ones. The concrete threat remains harvesting encrypted data today in order to decrypt it later, once a sufficiently powerful machine exists.

• Start or continue the inventory of RSA and elliptic-curve usage across your systems, applications and certificates.
• Deal first with data that must stay confidential for a long time, and with key exchanges. Hybrid key exchange with ML-KEM is already offered by recent browsers and by OpenSSL since version 3.5.
• Follow the European roadmap: migration under way by the end of 2026, high-risk systems protected by 2030. Our six-step guide explains where to start.

The next step to watch is the larger-scale demonstration Google has promised, and above all the use of these states in a real computation.