Google Willow's Magic-State Breakthrough: 40× Fewer Errors, Not 40× Closer to Breaking RSA

Type: Technical Analysis
Published: October 2026
Keywords: Magic State Cultivation, Google Willow, T Gates, Fault-Tolerant Quantum Computing, Surface Code, Color Code, Shor's Algorithm, RSA-2048, Elliptic Curve Cryptography, Bitcoin, Post-Quantum Migration

Abstract

In October 2026, Google Quantum AI published in Science the first hardware demonstration of magic state cultivation [1][2]. Magic state cultivation is a protocol for preparing the high-fidelity "magic" states that fault-tolerant quantum computers consume to execute T and Toffoli gates. On the 105-qubit Willow processor, cultivation reduced the logical error of a prepared |T⟩ state by a factor of 40 relative to plain state injection, reaching a fidelity of 0.9999(1) while retaining 8% of attempts. Because Shor's algorithm against RSA and elliptic-curve cryptography consumes hundreds of millions to billions of such states, parts of the crypto press read the result as a step toward Q-Day. This analysis examines what the experiment actually measured, how cultivation fits into published RSA-2048 and ECC resource estimates, and how large the remaining gap is. We argue that Willow did not make cryptographic attacks cheaper. It turned an assumption that was already built into today's lowest surface-code resource estimates into experimental evidence. Throughout, we separate what the paper establishes from what we infer for post-quantum planning. See also our publication series.

Key Points at a Glance

1. What Google Actually Demonstrated

The paper, Magic state cultivation on a superconducting quantum processor, by Emma Rosenfeld, Craig Gidney and nearly 300 co-authors at Google Quantum AI, first appeared as a preprint in December 2025 [1] and was published in Science on 15 October 2026. It implements on real hardware a protocol that Gidney, Shutty and Jones proposed theoretically in 2024 [3]. The headline numbers are:

Parameter Reported value
Hardware Willow, 105 superconducting transmon qubits on a square lattice
Codes Injection and cultivation in a distance-3 color code; "grafting" into a distance-5 surface-code-compatible layout (54 qubits, the largest experiment in the paper)
|T⟩ error, injection only 4.4(2)×10−3 (76% of attempts retained)
|T⟩ error, with cultivation Upper bound of 1(1)×10−4; fidelity 0.9999(1) (8% of attempts retained)
Improvement ~40× lower logical error than injection
Calibration Reinforcement-learning agent, ~4 hours of training before data collection; improved both logical error and retention by about an order of magnitude

Two details matter for interpreting these figures. First, the 40× compares cultivated states with injected ones: raw magic states loaded into the code with no clean-up at all. It shows that cultivation works, but it is not a cost figure. The cost question is whether cultivation produces states of a given quality with fewer qubits and less time than magic state distillation, the older, factory-based method, or at least replaces its most expensive stages. The theory says it does, and the lowest surface-code RSA-2048 estimate already assumes those savings (Section 4). This experiment did not measure them. Second, the reinforcement-learning calibration was not a minor detail: the authors describe it as crucial for observing the reported fidelity and post-selection rates. AI is now part of the hardware stack as well as the cryptanalysis stack, a trend we also noted in our analysis of the AI-discovered attack on HAWK.

🔬 Kickback Tomography: Measuring a 1-in-10,000 Error Honestly

Verifying an error rate near 10−4 is itself hard. Standard state tomography would need on the order of 108 shots to resolve it. The authors also point out that post-selected tomography can overestimate purity in the presence of coherent noise.

Their solution, which they call kickback tomography, runs additional cultivation rounds as fault-tolerant measurements along the |T⟩ axis. This yields an upper bound on the error with about 104 measurements, at the cost of a statistical uncertainty comparable to the error itself, which is why the bound is quoted as 1(1)×10−4 and the fidelity as 0.9999(1). For readers assessing claims, this is a point in the paper's favour: the 99.99% figure rests on a fault-tolerant upper bound rather than on tomography that can overstate purity, although the bound itself carries a large uncertainty.

2. Why Magic States Are the Bottleneck for Shor's Algorithm

Error-correcting codes such as the surface code make a specific family of operations, the Clifford gates, comparatively cheap and robust. Clifford gates alone, however, cannot run useful algorithms; they can be simulated efficiently on a classical computer. Universality requires at least one non-Clifford gate, usually the T gate or the three-qubit Toffoli (CCZ) gate.

Fault-tolerant architectures do not apply T gates directly. Instead, they prepare a special resource state, the magic state |T⟩, and consume it through a Clifford-only "teleportation" circuit. Every T gate costs one magic state, and every Toffoli costs the equivalent of several. Shor's algorithm is dominated by modular arithmetic, which is built almost entirely from Toffoli gates. Our analysis of Google's ECC white paper discussed circuits with 70–90 million Toffoli gates for 256-bit elliptic curves; RSA-2048 requires billions.

This creates a simple error budget: if a computation consumes N magic states, each must fail with probability well below 1/N, or the computation almost certainly fails. That is why the paper cites infidelities around 10−10 for RSA-2048 and 10−6 to 10−8 for some simulation and optimisation workloads [1].

The traditional route to such fidelities is magic state distillation: many noisy states are fed into a "factory" circuit that outputs fewer, better ones. Factories are large. Rosenfeld told Scientific American that with distillation, "up to 95 percent" of a quantum computer could be spent just generating high-fidelity magic states [7].

Cultivation takes a different route. Instead of a separate factory, a single noisy state is injected into a small code patch, repeatedly checked, and grown in place. Any detected error causes an immediate restart, which is cheap because the patch is small. The 2024 theory paper, titled growing T states as cheap as CNOT gates, estimated logical errors as low as 2×10−9 at 10−3 physical noise, using an order of magnitude fewer qubit-rounds than prior work [3].

Figure 1: Magic State Cultivation as Run on Willow
1
Inject
A noisy |T⟩ state is encoded into a small distance-3 color code. Error ~4.4×10−3.
Noisy
2
Cultivate (check and post-select)
Repeated fault-tolerant checks of the T-basis observable. Any detected error discards the attempt; about 92% are discarded.
Discard on error
3
Accept
Surviving states have an error bounded at about 1×10−4, about 40× better than injection.
Fidelity 0.9999
4
Graft
The state is transferred into a larger distance-5 surface-code-compatible layout (54 qubits) to be stored and used.
Ready to use

3. 40× Fewer Errors ≠ 40× Cheaper Attack

Within a day of publication, headlines tied the result to Bitcoin and RSA. CoinDesk ran "Satoshi-era bitcoin faces a bigger quantum threat after Google's new Willow breakthrough" [8], and The Block reported on observers weighing the Q-Day implications [9]. On social media, the 40× figure was frequently restated as an attack becoming "40× cheaper". That reading does not follow from the paper.

⚠️ What the 40× Does and Does Not Measure

It measures: the ratio between the logical error of a |T⟩ state prepared by injection (4.4×10−3) and one prepared by cultivation (an upper bound of ~1×10−4), on accepted attempts, at distance 3.

It does not measure: the number of physical qubits, the wall-clock time, or the total number of operations needed to produce a magic state of a given quality. It also includes no comparison with a distillation factory. In fact, accepted states became 10 times rarer (8% vs. 76% retention) while becoming 40 times better. Whether that trade is favourable at scale is exactly what the theory predicts but the experiment has not yet shown.

Google is explicit on this point. The accompanying blog post states that the team "still need[s] to demonstrate magic state cultivation at a larger scale" [2], and Rosenfeld described the work as a step in the right direction rather than a practical breakthrough [7]. Independent experts are positive about the scientific result itself. Kenneth Brown, director of the Duke Quantum Center, said: "The Google experiment shows that cultivation works in practice" [7]. The accurate summary is that a key protocol now works on real hardware, at small scale, as designed.

4. The Cryptographic Link: Already Priced Into Today's Estimates

The most important context for security teams is that cultivation is not new to cryptographic resource estimation. It has been part of the lowest published surface-code estimate for RSA-2048 since May 2025.

Estimate Target Physical qubits Runtime Uses cultivation?
Gidney & Ekerå (2019) [5] RSA-2048 ~20 million ~8 hours No (distillation)
Gidney (2025) [4] RSA-2048 < 1 million < 1 week Yes, followed by a small distillation stage
Google Quantum AI (2026) [6] 256-bit ECC (secp256k1) < 500,000 ~18–23 minutes Yes

Gidney's 2025 paper attributes its roughly 20-fold reduction in qubit count to three ingredients: approximate residue arithmetic, storing idle logical qubits in denser "yoked" surface codes, and allocating far less space to magic-state production thanks to cultivation [4]. In that design, cultivation produces T states at about 10−7, and a small 8T-to-CCZ distillation stage turns them into the Toffoli states the algorithm consumes, with errors below 10−12. Its hardware assumptions are unchanged from 2019: a square grid with nearest-neighbour connectivity, a uniform 0.1% gate error rate, a 1 µs surface-code cycle and a 10 µs control reaction time.

Lower figures have appeared since. Iceberg Quantum's Pinnacle architecture (February 2026) estimates fewer than 100,000 physical qubits for RSA-2048 using quantum LDPC codes [10], and a March 2026 neutral-atom proposal puts the minimum for Shor's algorithm near 10,000 reconfigurable atoms, with much longer runtimes [11]. Both rely on high-rate codes that need longer-range connections than a nearest-neighbour grid provides. We use Gidney's figure as the reference point here because it rests on the most conventional hardware assumptions.

The Willow experiment therefore does not move any number in this table. What it changes is the confidence attached to the middle row. Until this experiment appeared as a preprint in December 2025, the sub-million-qubit RSA estimate rested on a magic-state protocol that existed only in simulation. It now rests on a protocol whose first stages have been run on hardware, with a measured error reduction of about 40×. In our view, this is the real cryptographic significance of the paper: it removes one reason to dismiss today's lowest surface-code estimates as optimistic. It is our inference, not a claim the paper makes, and it applies only to the cultivation component, not to yoked codes, residue arithmetic or the overall machine.

💡 Why Hardware Validation Matters for Risk Models

Resource estimates are chains of assumptions. A risk model that treats each unvalidated link as a possible failure point will discount the estimate. Each link that is confirmed in hardware removes some of that discount. Cultivation was one of the newest and least-tested links in the RSA-2048 chain. It is now a tested one. Organisations that previously planned against the 2019 figure of 20 million qubits as a "safe" anchor have one fewer argument for doing so.

5. The Remaining Gap: Three to Six Orders of Magnitude

Validation of the mechanism is not the same as reaching the required performance. Figure 2 places the experimental result on the error scale that cryptographic attacks require. Two targets matter. The paper cites around 10−10 for the magic states that factoring RSA-2048 consumes, six orders of magnitude below Willow's bound. In Gidney's estimate, however, cultivation does not have to get there on its own: it must deliver T states at about 10−7, three orders of magnitude below Willow, and the distillation stage does the rest. The 2024 theory predicts that cultivation at 0.1% noise can go further still, to 2×10−9.

Figure 2: Magic-State Error Rates, Achieved vs. Required (log scale)
Magic-state error rates achieved on Willow compared with those required for applications A logarithmic axis from ten to the minus 2 to ten to the minus 10. Injection only on Willow is at 4.4 times ten to the minus 3. Cultivation on Willow is bounded at about ten to the minus 4. Halving physical noise could give about 2 times ten to the minus 5. Gidney's 2025 RSA estimate needs cultivated T states at about ten to the minus 7, three orders of magnitude below today's result. Chemistry and optimisation need ten to the minus 6 to ten to the minus 8. Cultivation theory at 0.1 percent noise predicts 2 times ten to the minus 9. The end-to-end requirement for RSA-2048 is about ten to the minus 10, roughly six orders of magnitude below today's result. ≈ 6 orders of magnitude to the end-to-end requirement ≈ 3 orders to Gidney's cultivation target (~10⁻⁷) 10⁻² 10⁻³ 10⁻⁴ 10⁻⁵ 10⁻⁶ 10⁻⁷ 10⁻⁸ 10⁻⁹ 10⁻¹⁰ Willow, injection only: 4.4×10⁻³ Willow, cultivated: ~10⁻⁴ Outlook, half the noise: ~2×10⁻⁵ Chemistry / optimisation: 10⁻⁶–10⁻⁸ Theory at 10⁻³ noise: 2×10⁻⁹ RSA-2048: ~10⁻¹⁰

The authors point to two routes for closing this gap. The first is lower physical noise: cultivated infidelity should scale roughly as p3, where p is the physical error strength, so halving p would bring the bound to about 2×10−5 [1]. The second is larger code distances. Both are expected, but neither is a small step, and several problems remain unresolved, most of them flagged by the authors themselves:

6. What It Means for Bitcoin and Other ECC Systems

Bitcoin, Ethereum and most of today's TLS key exchanges rely on the hardness of the elliptic-curve discrete logarithm problem, and Shor's algorithm against 256-bit curves has the same dependence on magic states as the RSA case. Elliptic-curve attacks need fewer Toffoli gates than RSA-2048, so their per-state error budget is somewhat looser, but it is still several orders of magnitude below what Willow achieved.

What does not change: the exposure model from our Bitcoin analysis and our ECC white-paper analysis. Coins whose public keys are already visible on-chain, including early pay-to-public-key outputs, reused addresses and Taproot (P2TR) outputs, can be targeted at any time once a capable machine exists. A fast-clock machine that can derive a key in minutes could also attack any coin while its spending transaction, which reveals the public key, waits to be confirmed. Willow does not alter which coins are exposed or how soon. What does change is the credibility of the sub-500,000-qubit ECC estimates we covered in our analysis of Google's ECC white paper, for the same reason as in the RSA case: one more ingredient of those estimates has been shown to work on hardware.

🚨 The Risk Is Not This Paper; It Is the Trend

A single small-scale experiment does not move Q-Day. The steady pattern behind it does. Resource estimates fell by an order of magnitude between 2019 and 2025, and the assumptions behind the new estimates are now being validated one by one. Data recorded today under classical key exchange can be stored and decrypted later (harvest now, decrypt later), so the relevant question is not whether a machine exists today. It is whether your data must still be confidential when one does.

7. What This Means for Your Post-Quantum Roadmap

The paper is a quantum-hardware result and makes no recommendations about cryptography. The conclusions below are ours, drawn from its findings together with the resource-estimate literature.

📋 Four Actionable Recommendations

  1. Plan against current estimates, not 2019 ones. Treat fewer than one million noisy qubits for RSA-2048 and fewer than 500,000 for 256-bit ECC as credible planning baselines. With cultivation now demonstrated, the argument that these figures rest on untested protocols has become weaker.
  2. Track the milestones that matter, not the headlines. The meaningful signals are cultivation at larger distances reaching 10−7 or below (the level Gidney's estimate assumes), magic states consumed in real time inside a logical computation, leakage removal that brings grafted storage in line with simulation, and several magic-state units operating in parallel.
  3. Keep deploying hybrid key exchange. Nothing here weakens the case for X25519 + ML-KEM-768 in TLS, VPNs and messaging. Our survey of the world's 100 largest banks shows how uneven adoption still is.
  4. Do not let signatures lag behind. Hybrid key exchange protects confidentiality, but signatures protect authenticity in code signing, firmware and PKI. Long-lived roots of trust need a migration path now; see our code-signing analysis.

Google's result is good science, carefully measured and honestly qualified by its authors. For the cryptographic community, its message is quieter than the headlines suggest but more durable: the engineering path behind today's sub-million-qubit attack estimates is being built, one validated component at a time. Migration plans should be built on the assumption that the remaining components will follow.

Further Reading

For the resource estimates that cultivation feeds into, including the on-spend, at-rest and on-setup attack classes for blockchains, see our analysis of Google's ECC white paper:

Read: Google's ECC Attack Estimates →

How to Cite This Article

APA: PostQuantumSecurity.org. (2026, October 19). Google Willow's Magic-State Breakthrough: 40× Fewer Errors, Not 40× Closer to Breaking RSA. https://www.postquantumsecurity.org/publications/google_willow.html

IEEE: PostQuantumSecurity.org, “Google Willow's Magic-State Breakthrough: 40× Fewer Errors, Not 40× Closer to Breaking RSA,” Oct. 19, 2026. [Online]. Available: https://www.postquantumsecurity.org/publications/google_willow.html

LaTeX/BibTeX:

@misc{pqcryptography_google_willow,
  author       = {{PostQuantumSecurity.org}},
  title        = {Google Willow's Magic-State Breakthrough: 40$\times$ Fewer Errors, Not 40$\times$ Closer to Breaking RSA},
  year         = {2026},
  month        = oct,
  day          = {19},
  url          = {https://www.postquantumsecurity.org/publications/google_willow.html}
}

References

  1. Rosenfeld, E., Gidney, C., Roberts, G., Morvan, A., Lacroix, N., et al. (2026). Magic state cultivation on a superconducting quantum processor. Science. https://doi.org/10.1126/science.aee7961. Preprint: arXiv:2512.13908
  2. Rosenfeld, E., & Gidney, C. (2026). Bringing the magic: Google breaks open a bottleneck in quantum computing. Google Blog. https://blog.google/innovation-and-ai/models-and-research/quantum-computing/magic-state-cultivation-quantum-computing/
  3. Gidney, C., Shutty, N., & Jones, C. (2024). Magic state cultivation: growing T states as cheap as CNOT gates. arXiv:2409.17595
  4. Gidney, C. (2025). How to factor 2048 bit RSA integers with less than a million noisy qubits. arXiv:2505.15917
  5. Gidney, C., & Ekerå, M. (2021). How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, 433. arXiv:1905.09749
  6. Google Quantum AI. (2026). Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations. https://quantumai.google/static/site-assets/downloads/cryptocurrency-whitepaper.pdf
  7. Scientific American. (2026). Google's quantum Willow chip may be able to grow 'magic states'. https://www.scientificamerican.com/article/googles-quantum-willow-chip-may-be-able-to-grow-magic-states/
  8. CoinDesk. (2026, October 16). Satoshi-era bitcoin faces a bigger quantum threat after Google's new Willow breakthrough. https://www.coindesk.com/tech/2026/10/16/satoshi-era-bitcoin-faces-a-bigger-quantum-threat-after-google-s-new-willow-breakthrough
  9. The Block. (2026, October 16). Google demonstrates quantum computing breakthrough as observers weigh Q-day implications. https://www.theblock.co/news/web3/2026-10-16-google-quantum-computing-breakthrough-418787
  10. Webster, P., Berent, L., Chandra, O., Hockings, E. T., Baspin, N., Thomsen, F., Smith, S. C., & Cohen, L. Z. (2026). The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes. arXiv:2602.11457
  11. Cain, M., et al. (2026). Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits. arXiv:2603.28627