Google's Magic-State Cultivation Result in Science, 15 October 2026: What the Willow Experiment Tests in the Under-a-Million-Qubit RSA-2048 Estimate
In July 1909 Fritz Haber showed visitors from BASF a tabletop apparatus that pulled nitrogen from the air and turned it into ammonia, drop by drop, without stopping. The chemistry had been argued on paper for years. The demonstration settled a narrower and more useful question: whether the key step worked in a real machine, under real pressure, at all. Turning it into fertilizer for a continent took Carl Bosch's engineers until 1913, when the Oppau plant opened. People who planned around nitrogen supply after 1909 had a new fact to work with, and the large engineering task was still ahead of them.
Google Quantum AI's paper of 15 October 2026 belongs to the same category of event. It takes one step that a famous resource estimate depends on, and shows that the step works on hardware.
What Google's Willow team reported in Science on 15 October 2026
The paper, "Magic state cultivation on a superconducting quantum processor" by Emma Rosenfeld, Craig Gidney and a large Google Quantum AI team, appeared in Science on 15 October 2026. The experimental work itself has been public as a preprint on arXiv since 15 December 2025; October brings its publication after peer review. The abstract states the result in one line: cultivation reduces the error by a factor of 40, with a state fidelity of 0.9999(1), retaining 8% of attempts. Google's announcement the same day calls it the first demonstration of a practical solution to one of quantum computing's most severe resource bottlenecks, and adds a sentence that deserves equal weight: the team still needs to demonstrate cultivation at a larger scale.
Practical takeaway. The October paper turns one assumption inside the best-known RSA-2048 estimate into an experimental result. It does not shorten any published migration deadline, and the error bound it reaches sits about six orders of magnitude above the level cited for cryptanalysis.
Why magic states cost so much: the T gate, distillation and the 2024 cultivation proposal
A quantum computer's easy operations, the Clifford gates, can be simulated efficiently on a classical computer. Universal fault-tolerant computation also needs a non-Clifford gate, usually the T gate. In error-corrected designs the T gate is performed by consuming a specially prepared qubit called a magic state. Each one is used once, and any flaw in it becomes a flaw in the computation. Rosenfeld told Scientific American that with the standard recipe, distillation, up to 95 percent of a quantum computer could be spent generating these states.
In September 2024 Gidney, Noah Shutty and Cody Jones proposed cultivation. A rough state is injected into a small patch of qubits, checked repeatedly, discarded when a check fails, and grown into a larger code when it passes. Their simulations put the cost at roughly that of one lattice-surgery CNOT gate of equal reliability, about an order of magnitude fewer qubit-rounds than prior methods, reaching logical error rates near 2 × 10-9 at 0.1% physical noise. The authors wrote that further distillation may never be needed in practice. That was a simulation claim, and the October paper is its first hardware test.
How the Willow experiment worked: a distance-3 color code, an error bound near one in 10,000, and a separate graft into a distance-5 surface code
Scientific American reports that the experiment used 54 of Willow's 105 physical qubits. The preprint describes two distinct results. In the first, a rough magic state injected into a small distance-3 color code is checked by cultivation, which asks it, in effect, whether it is the right state. A fault-tolerant method the team calls kickback tomography then bounds its error at about 1 × 10-4, some 40 times lower than injection alone, counting only the roughly 8% of runs in which no error was detected. Scientific American puts the injection-only failure rate at about four in 1,000. In the second result, the team grafted a cultivated state into a distance-5 surface code, the error-correcting layout Google's processors already run. That step shows the state can be carried into the larger code; the paper notes that idle errors in the grafted code still limit the state there, so the 10-4 figure belongs to the first experiment.
Two further details matter for anyone who reads these results for a living. First, the price of purity is attrition: Kenneth Brown of Duke University, who was not involved, told Scientific American that the quality check discards 92 percent of attempts. That is the design working as intended, and it means throughput, the number of good states per second, becomes the engineering variable to watch. Second, Google's announcement recounts that Rosenfeld's early data appeared to defy physics until the team traced it to slow drift in lab electronics and temperature that had quietly invalidated the standard benchmark. The fix was a new method that uses cultivation to measure itself. Measurement, in other words, had to be rebuilt before the result could be trusted, which is a useful caution for every vendor fidelity figure that arrives without its method.
Where cultivation sits in Craig Gidney's May 2025 RSA-2048 estimate
In May 2025 Gidney published "How to factor 2048 bit RSA integers with less than a million noisy qubits". It cut his own 2019 figure of 20 million qubits to under one million, with a runtime of under a week. The abstract names three sources of the reduction: approximate residue arithmetic, yoked surface codes for idle qubits, and less space allocated to magic-state production by using cultivation. It keeps the 2019 hardware assumptions: a square grid with nearest-neighbor connections, a uniform 0.1% gate error rate, a 1-microsecond surface-code cycle and a 10-microsecond control reaction time.
Read against that list, the Willow result confirms one ingredient. It does not test the other two, and it does not show a machine near a million qubits. It also leaves a precise quantitative gap. Scientific American reports that breaking RSA-2048 would require magic states that fail about once in 10 billion tries, and that simulating molecules, the nearer use, needs one in a million to one in 100 million. Willow's measured bound of about 10-4 sits roughly six orders of magnitude above that benchmark. The comparison gives an order of magnitude only: one number is a small-distance laboratory bound on retained states, the other a requirement for a full magic-state factory. The 2024 simulations say cultivation can close much of that gap at larger code distances and lower physical noise; the October paper shows the method at small distance, which is exactly where a first hardware result should start.
Classical computing keeps moving too. Quentir wrote in September about Stephen Weis factoring RSA-896 with idle GPU capacity, a reminder that RSA's margin erodes from two directions at once, and that the quantum line is only one of them.
Why the result leaves NIST's proposed 2030 and 2035 dates where they were
The post-quantum calendar was drafted before this paper and does not depend on it. The initial public draft of NIST IR 8547, published 12 November 2024, proposes deprecating quantum-vulnerable algorithms such as RSA-2048 after 2030 and disallowing them after 2035. Those proposed dates rest on the time large organizations need to replace cryptography across products, contracts and suppliers. A hardware result like this one tells planners that one engineering doubt has become smaller. It gives no reason to wait, and no reason to panic.
The people with the most at stake are those whose data must stay confidential for decades: patients whose records hospitals keep for a lifetime, citizens whose tax and identity files sit in government archives, and companies whose trade secrets outlast any product cycle. Anything encrypted with RSA today and recorded in transit can be read later if a capable machine arrives. That exposure predates this paper. Cultivation adds to the engineering case that such a machine can be built.
How Quentir Reads It
The October paper is a good example of how quantum progress now arrives: a theory paper in 2024, a resource estimate that leans on it in 2025, the hardware result as a preprint in December 2025, and its peer-reviewed publication ten months later, with the decisive scale-up still ahead. Each step is real, and none of them alone sets a date. The independent testing that DARPA's Quantum Benchmarking Initiative is funding through Stage C exists for exactly this reason, because laboratories report their best runs and buyers need comparable ones. The two numbers worth tracking from here are throughput of good magic states per second and the logical error rate at distances above five. Either would move the estimate more than any headline.
For organizations, the practical consequence is calendar discipline. The dates that bind procurement and certificates are policy and platform dates, and they arrive years before any credible cryptanalytic machine. Quentir's Signature Brief 2026.9, October 19 Comes Before 2030, maps six of those dates in September and October 2026 against the federal and EU destinations they sit inside, with the artifact to ask for before each date; this post covers the physics and leaves the calendar to that edition. The next signal to watch is whether Google or another group reports cultivation at distance 7 or beyond with a throughput figure attached.
Sources: E. Rosenfeld, C. Gidney et al., "Magic state cultivation on a superconducting quantum processor", Science, 15 October 2026 (doi 10.1126/science.aee7961); preprint arXiv:2512.13908, 15 December 2025; Google, "Bringing the magic: Google breaks open a bottleneck in quantum computing", 15 October 2026; Jacek Krywko, "Google's quantum Willow chip may be able to grow 'magic states'", Scientific American, 15 October 2026; C. Gidney, N. Shutty and C. Jones, "Magic state cultivation: growing T states as cheap as CNOT gates", arXiv:2409.17595, 26 September 2024; C. Gidney, "How to factor 2048 bit RSA integers with less than a million noisy qubits", arXiv:2505.15917, 21 May 2025; NIST, IR 8547 initial public draft, "Transition to Post-Quantum Cryptography Standards", 12 November 2024. The Science page itself was not accessible at the time of writing; experimental figures are taken from the authors' preprint abstract, Google's announcement and Scientific American's report. The Haber demonstration of July 1909 and the opening of BASF's Oppau plant in 1913 are standard history of the Haber-Bosch process.
Published intelligence, built to inform your own decisions. Published: October 16, 2026.