AI-designed quantum circuits: how Claude rebuilt eight circuits without keeping its scratch work

What happened

On October 16, 2026, Anthropic published "Designing more efficient quantum circuits with Claude". The paper behind it is on arXiv as 2610.22367.

The work was led by Andi Gu in Anthropic's STEM Fellows program, mentored by Anthropic quantum physicist Alek Kemeny, with Susanne Yelin and Mikhail Lukin of Harvard. The model was Claude Mythos 5.

The job: eight circuit "primitives" from chemistry, optimization, quantum simulation, number theory and numerical computing. Humans wrote a short text description of each. Then a closed loop ran, with no human stepping in between rounds:

• Claude writes a circuit design in Python.
• A separate evaluator checks that the circuit is correct and scores it.
• Claude reads the score, reflects, and revises.

The score is T×Q. T counts Toffoli gates. Q is the most logical qubits in use at any one time. Multiply them; lower is better. The authors weight time and space equally "for simplicity" and note that other exponents would work too.

Result: in seven of the eight tasks Claude cut both Toffoli gates and qubits. The eighth, modular inversion over a prime field, is a new reversible design that traces out a time–space trade-off curve rather than beating one particular earlier circuit.

The search ran inside the OpenEvolve framework. Claude first sketched up to five families of algorithms, evolved them in parallel, and swapped strong candidates between them from time to time. The point-addition and modular-inverse run took 53 hours. The humans supplied one paragraph and a few nudges to "think more broadly".

Why quantum circuits are so hard to write

An ordinary program branches all the time: if x is above 0, go this way, otherwise go that way. A quantum circuit can't. Its input is often a superposition of many numbers at once. The circuit can't take a peek and then pick a path, because peeking destroys the superposition. Every branch has to be built from controlled gates, with both paths laid down.

The second problem is scratch work. A normal computer finishes and simply clears its intermediate results. A quantum circuit can't just clear a wire. Every step has to be reversible: from the output you must be able to work back to exactly one input.

The usual fix is to compute, copy, and run it backwards. Work out the answer, copy it onto an output wire, then run the computation in reverse so the scratch wires return to 0 on their own. That roughly doubles the gate count. The other option is to keep the scratch, and then the qubit count keeps climbing.

Underneath sits a law of physics, Landauer's principle: erasing one bit of information releases at least kT·ln 2 of heat into the surroundings. Erased information doesn't vanish. It leaks into the environment, and for a quantum circuit, information leaking into the environment is exactly what breaks a superposition.

Story one: no stored scratch, rebuild it from the result (divsteps modular inversion)

Bitcoin and Ethereum sign with elliptic curves. The core operation is point addition, and its most expensive step is a modular inverse: find x so that a·x leaves remainder 1 when divided by p.

Classical computers have a good algorithm for this, divsteps (Bernstein and Yang, 2019). It repeats three moves: swap, add or subtract, halve. Which move each step makes is one bit of scratch information, and a classical machine just throws it away.

A quantum circuit can't throw it away. Store every step's branch bit and the qubit count grows in step with the number of steps. That used to be considered impractical.

Claude's idea: the branch information can be decoded from the numbers themselves. It proved several new algebraic identities that give the decoding formulas, checked them with large numerical simulations, then formalized them in Lean. Its first simple guessing rules worked on small numbers and failed at 256 bits, which is what pushed it toward theory.

The paper's details: the swap bit at every step can be recovered with a cheap check, and so can the parity bit at about two thirds of steps. The remaining ambiguous steps are either decoded or pushed onto a small stack. The depth-2 decoding rule is b = 1 ⊕ f₁ ⊕ q₁; the rules for depths 2 to 5 have 3, 3, 11 and 26 terms.

How much to store is a dial the paper calls j_store. At j_store = 0 the history stack needs 198 qubits (1,065 for the whole circuit). At j_store = 5 the stack is 60; at j_store = 9 it is just 24. The full curve runs from (3.6×10⁶ Toffolis, 1,031 qubits) to (7.9×10⁶ Toffolis, 893 qubits).

Against other modular-inverse circuits (the paper's Table S3):

• Schrottenloher 2026: 1.9×10⁶ Toffolis, 1,446 qubits.
• Claude's divstep circuit: 4.0×10⁶ Toffolis, 935 qubits.
• Luo et al. 2026 (packed Euclidean walk): 7.0×10⁷ Toffolis, 838 qubits.
• A dedicated Euclidean circuit: 2.1×10⁷ Toffolis, 843 qubits.

Anthropic's "12% more qubits, 17× fewer gates" is the comparison with Luo et al. Against Schrottenloher, Claude's circuit uses more Toffolis but fewer qubits. It is a different point on the trade-off, not a clean sweep.

The benchmark prime is p = 2²⁵⁶ − 2³² − 977. That is the field prime of secp256k1, the curve Bitcoin signs with. In the worst case g reaches 0 within 590 active steps. The failure budget for one modular inverse is at most 2×10⁻⁴.

Story two: switch algorithms, recompute, and size the reserve with 400 million simulations (the DQI decoder)

DQI stands for Decoded Quantum Interferometry (Jordan et al., 2024). It uses the quantum Fourier transform to turn an optimization problem into a decoding problem.

On a problem called Optimal Polynomial Intersection (OPI), DQI has a superpolynomial speedup. The dual code of that problem is a Reed–Solomon code, so the circuit has to run a reversible Reed–Solomon decoder.

A Google team (Khattar et al., 2025) built that circuit earlier. Its bottleneck was the extended Euclidean algorithm. Claude did three things:

• Switched algorithms. The core became the Berlekamp–Massey recurrence, whose rounds always follow the same steps. That suits a circuit that can't branch.
• Recomputed instead of storing. Most temporary values are not kept; they are recomputed backwards when needed. The discrepancy in a replacement round is fixed by the locator, so it can be erased and recomputed. Only the discrepancies of "keep" rounds go on a stack.
• Sized the reserve. How many stack slots? Never overflowing takes 35 slots, which is 665 qubits. Claude reserved 1 slot, which is 19 qubits.

The case for one slot is simulation. Over the DQI input distribution the team ran 400 million samples (Anthropic's article says 403 million). The two ways to fail, stack overflow and running past the cutoff, add up to a probability of 1.4×10⁻⁴. Anthropic's article puts it as roughly one failure in ten thousand.

Result: Toffolis fell from 5.1×10⁶ to 4.4×10⁵ and qubits from 1,938 to 1,837, about 12× less in T×Q. Anthropic says DQI's most expensive step became "a little more than an order of magnitude" cheaper.

Anthropic also cites Google's estimate for one OPI problem: about 3 months on the classical Frontier supercomputer versus about 1 hour on a future quantum computer. That is a projection for machines that don't exist yet, not a measurement.

The scoreboard for all eight tasks

This is the paper's Table 1. T is the Toffoli count, Q the qubit count. G is the baseline's T×Q divided by the new circuit's T×Q, so bigger means bigger savings. Every G shown is the paper's own figure.

The Hermitian DQI decoder had no reversible compilation before, so its baseline is a naive version and the paper reports no G. The modular inverse has no single baseline; Claude's row is the full benchmark circuit, and story one compares it with others.

Switch between T, Q and T×Q. The bars use a log scale: each major gridline to the right is 10× more.

Getting the FeMoco story right

FeMoco is the iron–molybdenum cofactor inside nitrogenase, the enzyme that fixes nitrogen. Computing its ground-state energy is a landmark goal of quantum chemistry, tied to nitrogen fixation and fertilizer.

In 2017 Reiher et al. estimated about 5×10¹³ (50 trillion) Toffoli gates. Today's estimate is about 3.4×10⁸ (340 million), from Low et al. 2025 using the same 54-orbital model. That is roughly 150,000× fewer, or a few hours on a machine with about 3 million physical qubits.

Anthropic's article says most of that drop came from redesigning circuits, not from better hardware, and that it took several research groups eight years.

Some Chinese coverage turned this into "humans needed 8 years, Claude needed 53 hours". That stitches two separate facts together:

• The 53 hours was Claude's search run on point addition and modular inversion.
• The 150,000× FeMoco drop was eight years of work by other groups. Anthropic used it to show that circuit design matters.
• FeMoco is not one of Claude's eight tasks.

The visible part of the paper gives no token count, no dollar cost, and no total number of candidate circuits tried.

The authors' own caveats

• Claude is "conservative by nature". It kept doubting improvements that looked real, sometimes re-checked results that were already well supported, and leaned toward familiar methods. The authors say that caution sometimes paid off; it is what led to the Lean proof. Their fix was to ask for several genuinely different approaches in parallel and to nudge it to widen the search now and then.
• The conclusion is worded carefully: these results suggest AI can now help redesign quantum circuits, and useful quantum computers "could arrive sooner". Circuit design is only one part of building one.
• The framework is bounded by how tasks are defined. The objective is fixed at T×Q. The interface is fixed in the computational basis, which rules out switching encodings (a coset representation, say). Results also depend on task boundaries and input distributions.
• Verification rests on three things. An external evaluator checks correctness: for Fe₂S₂, every table row plus 2²⁴ random inputs; for the lattice gauge task, 100,000 random inputs plus every group operation enumerated. Divsteps has a Lean proof. The DQI reserve rests on simulation.
• Anthropic's article says the work was formalized in Lean. The visible part of the paper mentions only exact proofs in Appendix A; we found no link to a Lean repository.
• Neither source mentions peer review or an independent replication.

What this has to do with your textbook

Most of what this research leans on shows up in high school or early college:

Number theory

Modular arithmetic, odd and even, greatest common divisors. Divsteps is a cousin of Euclid's algorithm: at each step, check whether g is odd, then add, subtract or halve. The gcd you learned is a working part of a digital signature.

Physics

Reversibility and energy. Landauer's principle says erasing information costs heat, and that is the root reason a quantum circuit can't throw scratch work away.

Statistics

Probability and tail risk. Reserve 1 slot or 35? The answer came from 400 million simulations: how rare does failure have to be before saving those qubits is worth it?

Chemistry

FeMoco in nitrogenase. Pinning down the energy of one molecule is among the most anticipated uses of a quantum computer.

Information theory

Error-correcting codes. Reed–Solomon codes also sit inside QR codes and CDs. DQI turns an optimization problem into a decoding problem.