Claude Mythos 5 Helped Design a Quantum Circuit for Bitcoin's secp256k1 Curve: What arXiv 2610.22367's '17-Fold Fewer Gates' Is Measured Against
In 1969 Volker Strassen showed that two 2-by-2 matrices can be multiplied with seven multiplications instead of eight. One saved multiplication, applied recursively, changed the cost of every large matrix product. In October 2022 DeepMind reported in Nature that a reinforcement-learning system, AlphaTensor, had found a scheme for 4-by-4 matrices in arithmetic modulo two using 47 multiplications, where Strassen's method applied twice needs 49. The machine searched; a mechanical check confirmed each scheme was correct; mathematicians then argued about what the result meant.
A paper posted to arXiv on 15 October 2026 belongs to the same family, with one difference that matters. The counted operation is the Toffoli gate, the expensive non-Clifford step in fault-tolerant quantum computing, and the arithmetic in question is the one Shor's algorithm uses to break elliptic-curve cryptography.
What Gu, Kemeny, Yelin and Lukin posted on 15 October 2026, and what Anthropic announced on 16 October
arXiv 2610.22367, "Discovering state-of-the-art quantum circuits with large language models," is a 46-page quant-ph paper by Andi Gu (Harvard and the Anthropic STEM Fellows Program), Alek H. Kemeny (Anthropic), Susanne F. Yelin (Harvard) and Mikhail D. Lukin (Harvard and QuEra Computing). It describes an evolutionary loop in which Claude Mythos 5 proposes circuit architectures and program rewrites and an independent evaluator verifies and scores them. The authors applied the loop to eight tasks in numerical computation, chemistry, optimization, quantum simulation and number theory. According to the abstract, in seven of the eight the discovered circuits significantly reduce both Toffoli and qubit counts against the state of the art; the eighth produced a new reversible architecture for prime-field modular inversion that improves the trade-off between the two.
Anthropic presented the work on 16 October. TokenPost's report of that announcement adds that the search ran for 53 hours and that designs were ranked by the product of Toffoli count and peak qubits. It also notes that the findings are circuit resource estimates and describe no run on quantum hardware and no attack on deployed cryptography. The circuits, tasks and evaluator are public in the authors' repository.
Practical takeaway. The secp256k1 point adder in arXiv 2610.22367 cuts Toffoli gates about 17-fold against one reconstructed baseline while adding 97 logical qubits. A second published adder uses fewer gates and more qubits. The circuit is deliberately approximate, with a stated failure bound of about 1.6 in 10,000 per addition. It marks a better point on a trade-off curve and changes no one's cryptography today.
Where the 17-fold figure comes from: a reconstructed Luo adder at 69.5 million Toffoli gates
The point-addition task asks for a reversible circuit that maps a quantum point P to P + Q, where Q is supplied classically, on the curve y² = x³ + 7 over the prime p = 2²⁵⁶ − 2³² − 977. That is the secp256k1 field. The construction descends from the reversible point adder of Proos and Zalka (2003), and its hardest internal step is modular inversion, which the new circuit performs with a reversible version of the divsteps algorithm that Bernstein and Yang published in 2019 for constant-time classical software.
The task's own table gives the figures. Its baseline is a 2026 space-efficient Euclidean point adder by Luo and colleagues, reconstructed by the authors at 69,529,757 Toffoli gates and 838 qubits. The best-ranked new circuit uses 4,006,673 Toffoli gates and 935 qubits. Dividing the two gate counts gives 17.4, and 935 against 838 is 11.6% more qubits, which is where the press figures of "about 17-fold" and "12% more" come from. A wider variant in the same family reaches 3,293,278 Toffoli gates at 1,191 qubits. A specialized version of the Euclidean baseline, also built by the authors, sits at 20,521,949 Toffoli gates and 843 qubits, so part of the distance between the baseline and the winner is closed by ordinary specialization before the divsteps design enters.
Because its qubit count rose against the baseline, the point adder is not among the seven tasks where both counts fell. Its gain is in the trade-off.
How it compares with Schrottenloher's 1.9 million-gate adder and the 2017 Microsoft bound
The same task file cites a second 2026 design, a binary-gcd point adder by Schrottenloher, at about 1.9 million Toffoli gates, 1,446 qubits and a gate-times-qubit cost of about 2.7 billion. The repository does not reproduce that circuit. Taken at the cited figures, it needs roughly half the Toffoli gates of the new adder and has the lower combined cost (2.7 billion against 3.75 billion), while the new adder needs 511 fewer qubits. Which design is better depends on whether a machine is limited by qubits or by the rate at which it can produce the magic states each Toffoli consumes. A headline that reports only the 17-fold comparison leaves this second design out.
For scale, Roetteler, Naehrig, Svore and Lauter (2017) bounded a complete Shor attack on a 256-bit prime-field curve at no more than 9n + 2⌈log₂ n⌉ + 10 logical qubits, which is 2,330 for n = 256. Their figure covers the whole algorithm, so it cannot be set directly against a single adder. The task documentation notes that the windowed algorithm of Babbush and colleagues (2026) calls the point adder 28 times, which is how a cheaper adder multiplies through a full attack. Quentir followed the qubit side of that work in September, when Georgia Tech's Jo and Lee reduced the elliptic-curve attack to 5n/2 + o(n) logical qubits, asymptotically.
How the circuit's correctness is established: a 1.6-in-10,000 failure bound, a Lean lemma and 100,000 tests
The new adder is approximate by design, and the repository says so plainly. A worst-case analysis by Wuille (2021) shows that 590 divsteps suffice for every nonzero input; the circuit runs a fixed schedule of 533 steps and accepts that a rare input will not finish. The paper's union bound puts the resulting failure probability at 1.599 × 10⁻⁴ per point addition. The task documentation estimates that, inside a windowed attack calling the adder 28 times, this budget adds less than 0.6% retry overhead. For an algorithm that is repeated anyway, trading a small failure rate for millions of saved gates is a sound engineering choice.
Three different kinds of assurance stand behind the count, and they should be kept apart. The failure bound is an analytic argument in the paper. One specific step, recovering which update a divstep applied so the circuit can run backward, is proved as a lemma, with a Lean 4 version in the repository. The implemented circuit as a whole is checked empirically: the evaluator runs 100,000 tests, with a new test set whenever the circuit changes, and passes a circuit with at most 20 failures, a budget the authors chose to make "approximate arithmetic and truncated inversion schedules legal." The reconstructed Luo baseline, by contrast, uses the exact 1,616-step bound and is exact on the tested domain.
This matters because AI-assisted search optimizes against whatever the grader rewards. AlphaTensor's schemes could be checked exactly by algebra. A 256-bit arithmetic circuit cannot be tested on every input, so the analytic bound, the proved lemma and the sampling rule together determine what the reported count means. We call this the verification class of an estimate: how its correctness was established, which should travel with the number wherever the number is quoted.
What a cheaper point adder changes for Bitcoin and other secp256k1 users, and what it leaves unchanged
secp256k1 carries the signatures that authorize Bitcoin and Ethereum transactions. A quantum computer able to run Shor's algorithm at this size could derive a private key from a public key that has already appeared on a ledger. Lower Toffoli counts per point addition lower the estimated non-Clifford budget of that attack, and a 17-fold reduction on one comparison, or roughly a doubling of gates against another in exchange for fewer qubits, both move the planning numbers.
Nothing in the paper changes what exists today. No machine runs these circuits, and the counts are logical, before the overhead of error correction. The Google magic-state cultivation result that Quentir read on 16 October addressed the other half of the cost, how cheaply hardware can supply the non-Clifford resource each Toffoli consumes. The two results arrived a day apart, one lowering the price of each gate, the other lowering how many gates are needed. For the holders of old addresses whose public keys are already exposed, and for the developers who maintain wallets and custody systems, the practical consequence, in our reading, is calendar pressure, though no deadline has moved because of this paper. The threshold at which a migration becomes urgent keeps being redrawn by work like this, and the redrawing now includes machine-searched designs.
How Quentir Reads It
The most durable finding in arXiv 2610.22367 concerns method. A frontier model, given a grader and 53 hours, produced arithmetic that specialists will now study, and the authors published the evaluator alongside the circuits so others can rerun it. That openness is what makes the result usable. It also shows where scrutiny belongs. When resource estimates start arriving from automated search, the baseline chosen and the verification class attached to each count become as consequential as the count itself, and both are easily lost in a headline.
Migration plans rest on these numbers. Agencies, banks and custodians set their post-quantum dates partly from published resource estimates, and they need to know which estimates were proven, which were sampled and against which design each improvement was measured. Quentir's Signature Report No. 2, the PQC Migration Roadmap, sets the finalized NIST standards, the EU and US regulatory calendar and a dated, phased migration plan in one document, with an internal-use license for the whole organization, for readers who need to place results like this one inside a migration schedule. The next step to watch is independent reproduction: whether other groups confirm the 4,006,673-gate count with the published evaluator, and whether the 1.599 × 10⁻⁴ failure bound holds up under their own testing.
Sources: Andi Gu, Alek H. Kemeny, Susanne F. Yelin and Mikhail D. Lukin, "Discovering state-of-the-art quantum circuits with large language models," arXiv 2610.22367, submitted 15 October 2026; authors' repository andigu/uncompute and its modinv-point-add task (circuit counts, baseline reconstruction, evaluator rule, Schrottenloher figures as cited there); TokenPost, "Claude Mythos 5 Helps Cut Quantum Circuit Gates by About 17-Fold," 17 October 2026, reporting Anthropic's 16 October announcement; John Proos and Christof Zalka, "Shor's discrete logarithm quantum algorithm for elliptic curves," 2003; Daniel J. Bernstein and Bo-Yin Yang, "Fast constant-time gcd computation and modular inversion," IACR ePrint 2019/266; Martin Roetteler, Michael Naehrig, Krysta M. Svore and Kristin Lauter, "Quantum resource estimates for computing elliptic curve discrete logarithms," arXiv 1706.06752, 2017; Alhussein Fawzi et al., "Discovering faster matrix multiplication algorithms with reinforcement learning," Nature 610, 5 October 2022. Ratios (17.4-fold, 11.6%) are Quentir's arithmetic from the repository counts.
Published intelligence, built to inform your own decisions. Published: October 18, 2026.