Future Horizons

Q-Day Is Coming: How Quantum Computers Threaten the Encryption AI Runs On

What is Q-Day? When will quantum computers break encryption, and can they break AI? 2026's qubit-estimate collapse and new 2029 PQC deadlines make "harvest now, decrypt later" the live threat to AI weights and data.

Gabriele Masetti · 2026-09-09

What Is Q-Day, and Why 2026 Made the Countdown Real

Q-Day is shorthand for the moment a quantum computer becomes powerful enough to break the public-key cryptography — RSA and elliptic-curve cryptography (ECC) — that secures nearly every encrypted connection on the internet, including the ones carrying AI model weights, training pipelines and API traffic. Nobody has announced Q-Day. What changed between May 2025 and March 2026 is that the distance to it, measured in qubits, collapsed three times in ten months, and two of the world's largest cloud vendors responded by moving their own internal deadlines up by years.

Google set March 25, 2026 as the date it told the industry it would migrate Chrome, Android and core infrastructure to post-quantum cryptography (PQC) by 2029, in a post co-authored by VP of Security Engineering Heather Adkins and Senior Cryptography Engineer Sophie Schmieg. Microsoft followed on June 30, 2026, pulling its own Quantum Safe Program deadline forward from 2033 to 2029. Azure CTO Mark Russinovich put it bluntly: "Advances in quantum research and development have shifted the risk horizon. We believe cryptographically relevant quantum computers could arrive sooner than previously expected — and the work required to prepare is significant, so organizations need to start now."

Neither company claims a cryptographically relevant quantum computer exists today. Both are reacting to a run of theoretical papers that shrank the hardware bar for breaking RSA and ECC faster than almost anyone in the field expected, and to a threat that doesn't need Q-Day to arrive at all: encrypted AI data captured now and stored for decryption later.

When Will Quantum Computers Break Encryption? The Qubit Estimate Collapse

The number everyone in cryptography watches is the qubit count needed to run Shor's algorithm against a 2,048-bit RSA key or a 256-bit elliptic curve. That number has fallen off a cliff since 2019.

Craig Gidney, a researcher at Google Quantum AI, and Martin Ekerå had estimated in a 2019 paper — later published in the journal Quantum in 2021 — that factoring a 2,048-bit RSA key would take roughly 20 million noisy physical qubits running for about eight hours. In May 2025, Gidney posted a new paper to arXiv, "How to factor 2048 bit RSA integers with less than a million noisy qubits," cutting that requirement by a factor of 20: fewer than 1 million noisy physical qubits, running for under a week.

The gains came from approximate modular arithmetic instead of exact computation, "yoked surface codes" for denser qubit storage, and a redesigned magic-state pipeline that cut the required Toffoli-gate count from trillions to roughly 6.5 billion.

Nine months later, a Sydney-based startup went further. On February 13, 2026, Iceberg Quantum published "The Pinnacle Architecture" on arXiv (2602.11457), arguing RSA-2048 could fall to under 100,000 physical qubits — another tenfold cut — by swapping surface codes for quantum low-density parity-check (QLDPC) codes, paired with a $6 million seed round led by LocalGlobe.

Then, on March 31, 2026, Google Quantum AI published its own reassessment — this time of elliptic-curve cryptography, not RSA. Ryan Babbush, Director of Research for Quantum Algorithms, and Hartmut Neven, VP of Engineering at Google Quantum AI, described a circuit that solves the 256-bit elliptic curve discrete logarithm problem (ECDLP-256) — the math underpinning ECC, Bitcoin and Ethereum signatures alike — using fewer than 1,200 to 1,450 logical qubits, translating to under 500,000 physical qubits, in a runtime of a few minutes rather than days.

Google called it "an approximately 20-fold reduction in the number of physical qubits required to solve ECDLP-256." Rather than publish the attack circuits outright, Google worked with the US government and researchers including Ethereum Foundation's Justin Drake and Stanford's Dan Boneh to release the estimate as a zero-knowledge proof — verifiable without handing over a blueprint.

None of this means a machine capable of running these circuits exists. IBM's own public roadmap targets its first large-scale fault-tolerant system, Quantum Starling, for 2029 — and Starling is specified at 200 logical qubits, roughly an order of magnitude short of what Google's own circuit needs for ECC-256, and further still from what RSA-2048 requires. The gap is still hardware, not math.

But the math side of that gap shrank three times between May 2025 and March 2026, and every one of those three papers came from a different lab using a different error-correction approach, which is what unsettled Google and Microsoft's security teams enough to move their own PQC deadlines up. No fourth estimate has landed in the six months since Google's elliptic-curve reassessment, and no machine has been built that can run any of the three circuits.

Can Quantum Computers Break AI? Separating the Model From the Pipe It Runs Through

The honest answer to "can quantum computers break AI" is that a cryptographically relevant quantum computer doesn't attack a model's weights or its training math directly — there's no quantum algorithm that reverses gradient descent or extracts a neural network's parameters faster than classical computers can. What Shor's algorithm attacks is the RSA and ECC key exchange and TLS certificates that protect the pipes those weights travel through: the encrypted channel a model gets downloaded over, the TLS session between an inference API and its caller, the code-signing certificate that vouches for a model checkpoint before it's deployed.

That distinction matters because it's exactly where AI companies are exposed. A frontier model's weights represent, in compute cost alone, hundreds of millions of dollars of training; the datasets behind them often contain licensed, scraped or user-submitted content with its own confidentiality expectations. All of that moves across TLS connections secured by the same RSA and ECC math Gidney, Iceberg Quantum and Google just showed is cheaper to break than assumed.

Model-serving APIs, multi-agent systems trading messages over the Model Context Protocol (MCP), and the checkpoint-distribution pipelines that ship weights from training clusters to inference fleets all inherit that exposure the moment they rely on classical public-key cryptography without a post-quantum upgrade path.

The Post-Quantum Cryptography Deadline Every Vendor Just Moved Up

Standards exist to fix this, and they've existed since August 13, 2024, when NIST finalized its first three post-quantum cryptography standards after an eight-year public evaluation: ML-KEM (FIPS 203, a key-encapsulation mechanism built on CRYSTALS-Kyber), ML-DSA (FIPS 204, a signature scheme built on CRYSTALS-Dilithium), and SLH-DSA (FIPS 205, a hash-based signature scheme kept as a structurally independent backup in case lattice-based math is ever broken). NIST's own transition guidance, Interagency Report 8547, sets 2030 as the year RSA and ECC get formally deprecated and 2035 as the year they're disallowed outright.

Government timelines have compressed to sit ahead of that. The NSA's Commercial National Security Algorithm Suite 2.0, built on ML-KEM-1024 and ML-DSA-87, requires all new National Security System acquisitions to support it starting January 1, 2027, with signed software and firmware fully transitioned by 2030 and full enforcement across national security systems by the end of 2031.

In June 2026, the White House went further for the wider federal government, issuing an executive order that moved the government-wide PQC deadline set by 2022's National Security Memorandum 10 — originally 2035 — up to December 31, 2030 for key establishment on high-value and high-impact systems, and December 31, 2031 for digital signatures, with the same dates extended to federal contractors through FAR rules.

The European Union set its own hard line at December 31, 2030 for critical infrastructure, expects every member state to have a national PQC migration plan filed by the end of 2026, and closes out the transition for all remaining systems by 2035.

Google and Microsoft's 2029 targets sit a year ahead of even NIST's 2030 deprecation date — both companies are choosing to move faster than any regulator has yet required them to, citing the qubit-estimate trend as the reason.

Harvest Now, Decrypt Later: The Threat Already Inside AI Infrastructure

None of the deadlines above are the live threat. The live threat is "harvest now, decrypt later" (HNDL): adversaries intercepting and storing today's encrypted traffic, betting that a cryptographically relevant quantum computer will eventually let them decrypt it. It requires no quantum hardware to execute today — only patience and storage — and multiple Western intelligence services, including the US NSA, UK NCSC, EU ENISA and Australia's ACSC, have issued guidance premised on the assumption that sophisticated adversaries are already doing exactly that.

AI infrastructure is a disproportionately attractive HNDL target because so much of it is designed to stay valuable for years. Forrester's "State Of Quantum Computing, 2026" report, published in March 2026, called practical quantum utility feasible within five years and described Q-Day itself as a plausible risk by 2030 — a window that lands squarely inside the multi-year confidentiality life of most training data and deployed model weights.

A 2025 NSA cybersecurity information sheet on AI data security, co-signed by CISA, the FBI and allied agencies, specifically calls out AI system operators to adopt quantum-resistant standards, pointing to the combination of high-value AI assets and the long operational lives of deployed systems as what elevates the risk.

Research from the Cloud Security Alliance mapping HNDL exposure across AI pipelines identifies data ingestion, transfer to training clusters, gradient synchronization, model checkpointing and distribution to inference endpoints as distinct interception points — each one a TLS session an adversary can record now and attack later. Multi-agent deployments compound the exposure: agents trading messages over MCP can open dozens or hundreds of TLS-protected channels per deployment, each a fresh HNDL collection target.

Training datasets containing health records, financial data or personal communications, in particular, carry confidentiality expectations that can run 10 years or longer — well within the window several of the 2026 qubit estimates suggest is plausible for a capable adversary to close.

Quantum Computing for AI: What's Real in 2026 and What's Still a Pitch Deck

Encryption-breaking is quantum computing acting against AI's infrastructure. The inverse pitch — quantum computing boosting AI itself, quantum machine learning (QML) — is a separate claim, and 2026 hasn't been the year it delivered a proven advantage. Industry analyses of the field this year are consistent on the point: QML does not outperform classical machine learning systems in practical deployments, and quantum processors remain in the NISQ (noisy intermediate-scale quantum) era, with today's chips running dozens to a few hundred qubits that are too error-prone for the deep circuits QML would need at scale.

The genuinely productive intersection of quantum computing and AI in 2026 sits in chemistry, not model training. On March 23, 2026, a Cleveland Clinic team led by Kenneth Merz, working with IBM, used an IBM Quantum Heron r2 processor to approximate the electronic structure of the 303-atom Trp-cage miniprotein — modeling both its folded and unfolded states through a hybrid workflow combining wave-function-based embedding with sample-based quantum diagonalization, splitting the molecule into fragments solved classically and fragments solved quantum-computationally.

Co-author Mario Motta called it "a step toward larger molecules." QuEra has separately demonstrated 96 verified logical qubits using a [[16,6,4]] high-rate error-correcting code on a 448-physical-qubit neutral-atom array, the closest any platform has come to the scale molecular simulation would need to be useful outside a research paper.

No enterprise workload runs on quantum hardware alone in 2026; every credible deployment pairs it with classical compute, and vendors pitching a standalone "quantum AI" product beyond that hybrid pattern are, at minimum, ahead of the hardware.

The clock that matters for AI infrastructure security isn't the one counting down to a QML breakthrough. It's the one on the calendar: the NSA's CNSA 2.0 requirement that every new National Security System acquisition support ML-KEM-1024 and ML-DSA-87 takes effect January 1, 2027.