Startup Breaks Google Quantum Encryption

A startup has reportedly found a way to break Google’s classified quantum cryptography system, according to details published in IEEE Spectrum.

The labs used a combination of classical and quantum techniques to defeat the cryptography. They did not need a full-scale quantum computer to do it. The attack relied on mathematical shortcuts that the original designers had overlooked.

Independent test findings

The team used commercially available quantum processors, not custom-built machines. That detail matters because it suggests the vulnerability is not theoretical — it’s exploitable with today’s technology.

Google had classified the cryptography as part of an internal project. The company did not submit it for public peer review before deploying it. Security experts have long warned that proprietary cryptography often contains hidden flaws.

The broader field of post-quantum cryptography has been moving toward open standards. NIST, the U.S. standards body, has been running a multi-year competition to select quantum-resistant algorithms that anyone can inspect. Google’s approach went in the opposite direction — keeping the details secret.

This is not the first time a company has tried to build its own crypto and gotten burned. The history of cryptography is littered with proprietary systems that failed when independent researchers got a look at them. The lesson tends to repeat itself every few years.

What makes this case different is the timing. Quantum computing is still in its early stages, but the threat it poses to current encryption is well understood. Companies are racing to protect their data before quantum machines become powerful enough to break RSA and elliptic-curve cryptography at scale, which is a concern for engineering history given the potential impact on secure communication.

For now, the attack does not affect standard encryption used by banks, email services, or messaging apps. It only applies to Google’s custom system. But the episode reinforces a basic principle: cryptography should never be trusted unless it has been tested publicly by people who have no reason to be polite about it.

The startup’s results have been shared with Google, according to the report. It is not clear whether Google has patched the vulnerability or changed its approach. The company did not comment publicly on the findings.

Independent verification remains the strongest tool the security community has. Without it, even the smartest engineers can miss things. The Google case is just the latest reminder.