Most of the secrets on the internet are protected by a simple bet. Multiplying two enormous prime numbers together is easy. Working backward from the result to find those two primes is so hard that an ordinary computer would need an impractically long time to do it, far longer than anyone could wait. Your bank, your messages, and much of the world’s commerce rest on that difficulty. In 1994, a mathematician named Peter Shor showed that a quantum computer could, in principle, perform the backward step quickly. His method has been called the most dangerous algorithm ever written. It has one weakness: no machine yet built can run it at any meaningful scale.
The usual way to describe that gap is to count qubits, the basic units of a quantum computer. Google’s Willow processor, among the most advanced, has a hundred and five. Breaking real encryption would take vastly more. But qubits are only part of the bill, and not the most interesting part. The deeper cost lies in something physicists, with a straight face, call magic.
Here is the problem in plain terms. Quantum computers make errors constantly, so engineers wrap their calculations in error-correcting codes, much as a careful accountant double-checks every sum. Some quantum operations are easy to protect this way. The catch is that those protected operations, on their own, cannot do anything an ordinary computer can’t. To reach genuinely quantum power, a machine needs a few extra operations that cannot be protected directly. The workaround is to prepare special ingredients, known as magic states, and feed them into the calculation. Each magic state can be used exactly once. Making clean ones is so expensive that, in some designs, theorists have estimated that up to ninety-five per cent of a quantum computer could be devoted to producing them.
Think of a bakery where flour and water cost almost nothing, but every loaf needs a pinch of a rare spice that must be made fresh, by hand, for that loaf alone. The size of the kitchen is not what limits the bakery. The spice is.
On October 15th, Google Quantum AI reported in Science that it had found a cheaper way to make the spice. The technique, called magic-state cultivation, was proposed on paper in 2024 by three of its researchers: Craig Gidney, Noah Shutty, and Cody Jones. It works like a filter. A rough, error-prone state is placed in a small patch of the chip and checked repeatedly. Flawed attempts are thrown away, and the survivors are grown into larger, sturdier forms. On Willow, the method cut errors roughly fortyfold compared with states made without it, and produced magic states with a record fidelity of 99.99 per cent. Getting there was not smooth. At one point, the team’s data seemed to defy the laws of physics. The culprit turned out to be ordinary lab noise, from drifting electronics and shifting temperatures, that had quietly fooled their measurements.
The result deserves both attention and restraint. Independent coverage noted that the experiment used, at most, fifty-four of Willow’s qubits, and that only about eight per cent of attempts passed every check. Google itself says that cultivation must still be shown to work at a much larger scale, and it offers no timeline for a useful machine. This is a laboratory proof, not a code-breaker.
Yet it belongs to a pattern worth noticing. The danger of Shor’s algorithm has rarely advanced through dramatic leaps. It advances through accounting.
In 2019, Gidney and a colleague, Martin Ekerå, estimated that cracking a standard 2,048-bit encryption key would require about twenty million noisy qubits running for eight hours. In May 2025, Gidney published a new estimate: fewer than a million qubits, working for less than a week. One of the main savings came from spending less of the machine on magic, by using cultivation, the very technique Google has now demonstrated on real hardware. Others have kept shaving the bill. In early 2026, a startup proposed a different architecture that might need fewer than a hundred thousand qubits. Researchers have also reworked the algorithm itself, including a faster variant from Oded Regev at New York University and a leaner, more noise-tolerant version from a team at M.I.T. None of these papers built a code-breaking machine. Each one simply lowered the price of building one.
A fair reader should keep the counterweight in view. These estimates assume machines far more reliable than anything that exists, with error rates and speeds no one has yet achieved at scale. Gidney himself has said his work is not a reason to panic. Many experts still expect a code-breaking quantum computer to be years, perhaps a decade or more, away.
The reason to care now is that encrypted data can be stolen today and read later. Security specialists call this “harvest now, decrypt later”: an adversary records encrypted traffic and stores it until the tools to unlock it arrive. Anything that must stay secret for many years is already exposed to that wait. This is why the U.S. National Institute of Standards and Technology finalized its first quantum-resistant encryption standards in August 2024, and urged organizations to begin switching immediately. The deadline for that migration is not the day a giant quantum computer is switched on. It is the day the bill becomes affordable to someone.
For thirty years, we have described the safety of our secrets as a wall. It was always closer to a price tag. Each quiet paper, each cleaner batch of magic, marks it down a little further. The engineers doing this work are not villains; their aim is a machine that could design new medicines and materials. But the same arithmetic serves both ends. Somewhere ahead lies the moment when the cost of breaking the lock falls below the value of what it protects. Nobody will announce it. We will find out, as usual, from the receipts.