Quantum computers can't break AI agent identity yet. Your audit trail still needs to plan for the day they can
Every AI agent identity in production today, ours included, rests on signatures that a large enough quantum computer could forge. Agents sign with Ed25519. Phone approvals use P-256. Plenty of identity systems still use RSA. Shor's algorithm breaks all three.
That sentence sounds alarming, so here is the calmer half. No machine that can do it exists. The best quantum computers today run tens of error-corrected logical qubits, while the published attacks need well over a thousand, running for days. Nobody is forging agent signatures with a quantum computer this year.
What changed is how fast the estimate of "enough" has been falling.
The numbers moved a lot in eighteen months
In May 2025 Craig Gidney of Google Quantum AI estimated that RSA-2048 could be broken with under one million noisy qubits in under a week. His own 2019 estimate had been 20 million qubits. In March 2026 a Google Quantum AI paper put the cost of breaking 256-bit elliptic-curve keys, the family Ed25519 and P-256 belong to, at under 500,000 physical qubits, roughly twenty times fewer than earlier work assumed. The paper measured secp256k1, the curve Bitcoin uses; other 256-bit curves are expected to be similar. Other teams have published lower figures still for different hardware.
Experts have shifted with the numbers. The Global Risk Institute's latest survey of 26 quantum researchers, published in March 2026, puts the chance of a cryptographically relevant quantum computer within ten years at between 28% and 49%. Google has set itself 2029 as the date to finish its own migration.
None of that is a prediction you should plan a product launch around. It is a range you should plan evidence around.
Why signatures are a different problem from encryption
Most quantum coverage talks about "harvest now, decrypt later", where someone records encrypted traffic today and reads it once a quantum computer arrives. The web has largely dealt with that already. Chrome, Cloudflare, Apple and Signal all negotiate post-quantum key exchange by default, and Cloudflare reported more than half of human traffic protected this way by late 2025.
Signatures carry the opposite risk, sometimes called "trust now, forge later". Nothing about a signature can be stolen today. The danger arrives on the day forging becomes possible, because from then on anyone could produce a valid-looking signature from an old classical key, including one dated years earlier. A signature made with Ed25519 stops proving anything about events after that day unless you can show, independently, that it existed before.
That matters a great deal for AI agents. The reason to sign an agent's actions is to have evidence that holds up later, in an audit, a dispute or a regulator's review. A refund an agent approved in 2026 may need defending in 2033. UK and EU timelines already assume this. The NCSC wants organisations to finish discovery and planning by 2028, move their most important systems by 2031 and complete migration by 2035. The EU's coordinated roadmap asks for high-risk uses to move by the end of 2030.
Quantum key distribution is not the answer for identity
You will see "quantum-secure identity" sold using quantum key distribution, which uses physics to share encryption keys over dedicated links. Both the NCSC and the NSA advise against relying on it. It needs special hardware, it does not prove who is on the other end, and it does nothing for a signature that must be checked years later by someone with an ordinary laptop. For agent identity the useful tool is post-quantum cryptography, which is ordinary maths running on ordinary computers.
The standards are ready, the plumbing is catching up
NIST finalised its first post-quantum standards in August 2024, including ML-DSA for signatures. In 2026 the IETF published RFC 9964, which defines how ML-DSA works in JOSE and COSE, the formats behind JSON Web Tokens and signed JSON. AWS KMS has offered ML-DSA keys inside hardware security modules since June 2025. Apple and Android now let phones hold ML-DSA keys in secure hardware too.
The catch is size. An Ed25519 signature is 64 bytes. An ML-DSA-44 signature is 2,420 bytes, and its public key is 1,312 bytes. That is fine for an audit record and awkward for every request on a busy network, which is why signature migration is moving more slowly than encryption. Some pieces are not ready at all. HTTP Message Signatures, the standard agents use to sign web requests (RFC 9421), has no post-quantum algorithm registered yet.
What this means for Vorim, honestly
Vorim is not quantum-safe today, and we won't call it that while any of its signatures depend only on classical keys. What we did get right early is structure. Every platform-signed record and every signed approval in Vorim carries an algorithm field, so a new algorithm is a new value rather than a new format, and our hash chains use SHA-256, which quantum attacks do not meaningfully weaken.
Here is the order we think makes sense for an agent identity platform, and how we are approaching it.
First, evidence that has to last. Spend receipts, swarm attestations, kill-switch measurements and audit exports should carry a second, post-quantum signature next to the current one, using ML-DSA from a hardware-backed key. Older records get the same protection by periodically signing the head of each hash chain with a post-quantum key while today's signatures can still be trusted, so they can later be proven to predate any quantum attack.
Second, agent keys. Hybrid keys that pair Ed25519 with ML-DSA let an agent stay compatible with today's verifiers while building a post-quantum record. That depends on key rotation that can change algorithm, which is on our list.
Third, the wire. We will follow the IETF on post-quantum HTTP message signatures rather than invent our own, because an agent's signature is only useful if the other side can check it.
If you run agents that sign anything you may need to defend in five years, the work to start now is an inventory of which keys sign what, and how long that evidence has to stay believable. Quantum computers do not change what your agents are allowed to do today. They change how long your proof of it lasts.