Insider Brief
- A new analysis argues that AI could accelerate quantum threats to encryption while helping organizations prepare their defenses.
- Data collected in encrypted form today could remain vulnerable to future quantum attacks, making information that needs years of protection a priority.
- Automated tools could help organizations find and replace vulnerable encryption, while quantum methods for detecting cyberattacks remain experimental.
Artificial intelligence could hasten quantum attacks on encryption while helping organizations prepare for them, according to a new analysis that calls for treating the technologies as a single cybersecurity challenge.
The paper, published in the Journal of Quantum Information Science by Troy Coienth Troublefield, of Capitol Technology University, proposes that AI’s growing role in quantum development will make it harder for businesses and governments to plan around a distant, fixed deadline for replacing vulnerable cryptography. At the same time, AI could help security teams locate that cryptography across sprawling computer systems and organize its replacement.
The immediate concern is that attackers could collect encrypted communications today and save them for a future quantum computer capable of reading them, according to the study. Organizations that wait until such a machine exists could protect new communications while leaving previously intercepted material exposed.
Rather than providing new experimental findings, the paper uses research, technical reporting, government standards and security assessments to present a strategic framework for helping organizations prepare for quantum cybersecurity threats, including identifying vulnerable encryption, prioritizing sensitive data and moving to quantum-resistant protection
A Moving Target for Encryption
The threat centers on public-key cryptography, including RSA and elliptic-curve systems, which help establish secure connections and verify digital identities. Their security rests on mathematical problems that conventional computers cannot practically solve at sufficiently large sizes.
A sufficiently capable quantum computer running Shor’s algorithm could solve those problems, undermining the affected systems. Today’s quantum processors remain too small and error-prone to carry out such attacks against widely used cryptography, the paper says.
One way AI could help close that gap is by improving quantum error correction, the paper suggests.
For example, AI could improve the performance of decoders, software that interprets error-checking measurements to determine what likely went wrong. Machine learning can help researchers develop decoders that identify errors more accurately or quickly, supporting the broader effort to build quantum computers capable of sustained, reliable calculations.
The analysis also points to declining estimates of the hardware required to break RSA-2048, a widely used form of RSA. Google researcher Craig Gidney’s 2025 estimate put the requirement below 1 million physical qubits, compared with an earlier estimate of about 20 million. These are theoretical resource estimates under specified assumptions, rather than demonstrated attacks or simple thresholds that any machine with enough qubits could meet.
Troublefiel writes that the reduction is not due to AI alone. More efficient algorithms, changes in error-correction methods and other improvements contributed to the lower estimates.
The Risk Begins Before the Attack
For security planners, the more useful question is how long information needs protection, according to the paper.
Medical records, intellectual property, classified information and some financial data can retain their sensitivity for decades. If intercepted communications remain valuable when a capable quantum computer arrives, their owners could face consequences long after the original collection.
This strategy, commonly called “harvest now, decrypt later,” gives organizations a reason to act without settling the debate over quantum computing’s development schedule.
Government agencies have warned that attackers could collect encrypted data now to unlock it with future quantum computers. But the paper notes that publicly available evidence does not establish who is collecting it or how much has been collected.
AI could intensify the incentive by helping adversaries sort collected material and prioritize information likely to retain value, according to the paper.
The exposure extends to AI infrastructure itself with the paper noting that training data, model files and sensitive information handled by autonomous software may require lasting protection. Troublefield recommends including those assets in the same cryptographic transition as other business systems.
AI’s More Immediate Defensive Role
The paper indicates that automated discovery — software that finds where an organization uses encryption and identifies methods vulnerable to future quantum attacks — could be a practical near-term use of AI.
Large organizations rely on cryptography across applications, software libraries, certificates, connected devices and services operated by suppliers. Before replacing vulnerable methods, security teams need to find them and understand which systems depend on one another.
According to the analysis, automated tools can help build that inventory, identify priorities and track changes as equipment and software are added or replaced. Some tools search for known cryptographic identifiers; others use machine learning to infer usage from patterns in code or network activity.
Those approaches have different capabilities and limitations. The paper notes that independent public evaluations of commercial tools’ accuracy, coverage and false alarms remain limited. Automated discovery therefore needs scrutiny rather than an assumption that every product provides a complete map.
Replacement methods are already available. The National Institute of Standards and Technology finalized its first three post-quantum cryptography standards in August 2024, covering methods for establishing shared secrets and producing digital signatures. These methods are designed to resist quantum attacks while running on conventional computers.
The operational challenge is coordinating their adoption across interconnected systems, according to Troublefield.
The proposed framework calls for prioritizing information with long confidentiality needs, maintaining a current cryptographic inventory, protecting AI infrastructure, designing systems so cryptographic methods can be replaced and planning backward from applicable deadlines.
That ability to replace methods, known as cryptographic agility, would also help organizations respond if weaknesses emerge in newer algorithms.
Quantum Security Tools Still Need Proof
Although more speculative right now, ongoing research is testing whether quantum computers could help AI spot cyberattacks by recognizing patterns in data.
The paper reviews studies applying such methods to intrusion detection, malicious activity and unusual network traffic. Some reported better results than the conventional methods selected for comparison.
However, it should be pointed out that the cited work appeared to use simulations or emulations rather than large-scale deployments on physical quantum processors or live production networks. Differences in datasets, experimental conditions and comparison methods also limit conclusions across studies.
Those results do not establish a general quantum advantage in cybersecurity, the analysis acknowledges. Researchers still need to show that performance holds across varied traffic, unfamiliar attacks and operating conditions outside controlled tests.
Other barriers include hardware errors, cost and the difficulty of explaining why a model flagged an activity as suspicious. That last issue matters when security analysts must investigate an alert and justify their response.
The broader paper has similar limits. As a conceptual synthesis, it inherits uncertainty from its sources and does not independently test its proposed framework against organizational costs, migration outcomes or competing security priorities.
Troublefield calls for more realistic evaluations of quantum security models, research on how autonomous AI systems should manage long-lived secrets and closer examination of the economics of collecting encrypted information for later use.
For organizations, the practical recommendation rests on work that can begin before those questions are answered. Identifying sensitive information and mapping its cryptographic dependencies would give security teams a clearer basis for deciding what to protect first, even while the quantum timeline remains uncertain.
Troublefield also lists affiliations with Capella University and the International School of Management, Paris.
