Short version. Anthropic says Claude Mythos 5 designed an elliptic-curve circuit with 17 times fewer gates for 12% more qubits. The paper's own table puts that 17x against the slowest prior design. Against the fastest one, the new circuit needs about twice the Toffoli gates and 35% fewer qubits. It's a real trade-off, not a sweep, and it doesn't move anyone's post-quantum timeline.
The headline number is true. It's just picked from one side of a table. On 16 October Anthropic published a post saying Claude Mythos 5, after a 53-hour run with an evaluator scoring every attempt, found quantum circuits that beat the state of the art in eight tasks. The line that travelled was the elliptic-curve one: "12% more qubits but 17x fewer gates" than "the smallest previous design." We opened the paper (arXiv:2610.22367, by Andi Gu, Alek Kemeny, Susanne Yelin and Mikhail Lukin) and went to the supplementary table that the claim comes from.
What Table S3 says
The benchmark isn't inversion on its own. It's a full point addition on the curve y² = x³ + 7 over the prime 2256 - 232 - 977. The paper doesn't name it, but those are the parameters of secp256k1, the curve Bitcoin signs with. Four circuits sit in Table S3:
| Design | Toffoli gates | Qubits | Toffolis × qubits |
|---|---|---|---|
| Schrottenloher (2026), binary gcd | 1.9 million | 1,446 | 2.7 × 109 |
| Claude's divstep circuit | 4.0 million | 935 | 3.7 × 109 |
| Luo et al., as rebuilt by the authors | 69.5 million | 838 | 5.8 × 1010 |
| Claude's specialised Luo schedule | 20.5 million | 843 | 1.7 × 1010 |
So the 17x is 69.5 million divided by 4.0 million, and the 12% is 935 qubits against Luo's 838. That's the comparison with the most qubit-frugal circuit, which is also by far the slowest. Put the divstep circuit next to Schrottenloher's instead and it uses 2.1 times as many Toffolis, while saving 511 qubits (35%). Multiply the two resources, the cost measure the paper uses everywhere else, and Schrottenloher's design still comes out lower.
The authors don't hide this. Their summary Table 1 leaves the gain column for this task empty, with a footnote saying prior circuits "trade Toffolis against qubits differently" so "we report no single baseline or gain." The abstract's own wording is that the new architecture "substantially improves the Toffoli-qubit trade-off." That's a fair description. "17x fewer gates" on its own isn't one, and it's the version that got repeated.
What's new, then
Quite a lot, as it turns out. Divsteps (the Bernstein and Yang inversion method that libsecp256k1 already uses on ordinary CPUs) had been considered impractical in reversible form, because every branch decision has to be remembered so it can be undone later. The paper's trick is to recompute most of those decisions from the registers instead of storing them, keep a small history stack for the rest, and let rare inputs fail. It schedules 533 steps where the worst case needs 590. In 100,000 test runs of the full point addition, four failed, which sits inside the failure budget the authors set for every design they compared.
The other seven tasks are cleaner wins. A fixed-point Gaussian drops 39x in Toffolis, an HHL rotation 32x, and in each of the seven both gates and qubits go down. The decoder for Google's decoded quantum interferometry (DQI) goes from 5.1 million Toffolis to 440,000, the 12x Anthropic quotes. One more number needs the same care as the 17x, though. The "665 qubits down to 19" in the post is the stack for exceptional values. The whole decoder goes from 1,938 qubits to 1,837.
Everything here was checked by simulation, at the circuit level, before any error correction overhead. Nothing ran on quantum hardware, and the paper says so plainly. The code is cited as andigu/uncompute on GitHub.
Does this change your post-quantum plan?
No. One point addition is a building block, and a real attack on a 256-bit curve repeats it many times, then pays for error correction on top. The paper gives no end-to-end estimate for breaking elliptic-curve keys, and we won't make one up for it. If your migration to hybrid key exchange was scheduled, keep the schedule. If it wasn't, this paper isn't the reason to panic, and it isn't a reason to relax either.
Where it does matter is the trend line. I might be wrong, but on early machines qubits look like the scarcer resource, so a design that gives up gates to save a third of the qubits could age better than the raw totals suggest. We'd wait for cryptographers to fold it into a full resource estimate before treating it as a shift. That's how the RSA-2048 numbers came down over the past decade, one subroutine at a time.
The method is the bigger story for us. An LLM proposing circuits, a strict evaluator rejecting the broken ones, 53 hours, no human between rounds. The authors note the model kept second-guessing results that were already sound. That's a less flashy line than 17x. It's also the one we'd quote.
If you're tracking where post-quantum crypto has actually landed in production, we covered ML-DSA reaching TLS and Classic McEliece becoming the first ISO post-quantum standard.
FAQ
Did Claude really cut quantum gates by 17 times?
Against one prior design, yes. The 17x compares Claude's divstep circuit (4.0 million Toffolis) with the authors' rebuild of Luo et al.'s qubit-frugal circuit (69.5 million). Against Schrottenloher's faster design (1.9 million Toffolis), it uses about twice as many gates and 35% fewer qubits.
Which elliptic curve did the paper use?
y² = x³ + 7 over the prime 2256 - 232 - 977. The paper doesn't name it, but those are the parameters of secp256k1, the curve used by Bitcoin.
Does this make elliptic-curve cryptography breakable sooner?
The paper doesn't say so and gives no full attack estimate. It improves one subroutine's trade-off between gates and qubits, at the circuit level, before error correction. Keep any post-quantum migration plan you already have.
Was any of this run on a quantum computer?
No. Every circuit was verified by classical simulation through the authors' evaluator. Four of 100,000 test runs of the full point addition failed, within the failure budget the authors set.
Sources. Anthropic, Designing more efficient quantum circuits with Claude (16 October 2026); Gu, Kemeny, Yelin and Lukin, Discovering state-of-the-art quantum circuits with large language models, arXiv:2610.22367 (Table 1, Table S3, SI II); Interesting Engineering (16 October 2026); Khattar et al., Verifiable quantum advantage via optimized DQI circuits.
