Explaining why this is a clickbait reveals important features of the current status of quantum computers and the quest for breaking encryption.

Factoring numbers is not just a mathematical curiosity. It is the backbone of much of the encryption that shields our digital lives. Every time we send a message, perform an online payment, or even load a secure website, we rely on the fact that multiplying two large prime numbers is easy, but breaking down that product back into its original primes is extremely hard. This asymmetry is what allows RSA and related cryptographic schemes to function safely at global scale.

Quantum computing is often presented as the technology that will overturn this assumption. Shor’s algorithm, the well-known quantum algorithm for factoring, offers an exponential speedup over any known classical method. On paper, it could make much of our cryptography obsolete almost overnight. In practice, however, the distance between theory and engineering reality remains substantial.

The largest number ever factored through a proper implementation of Shor's algorithm is still 15, a number small enough to factor mentally. Attempts to reach 21, and beyond have required shortcuts that bypass the algorithm's actual difficulty. As Craig Gidney explains in his analysis of these demonstrations, they avoid the hard part: running long, error-sensitive quantum circuits on reliable logical qubits. Even 15 itself is a special case, substantially easier than 21 despite both being trivial to factor by hand.

Yet this does not mean the threat to encryption is just hypothetical or too distant. It simply means the threat does not come from today’s quantum computers, but from tomorrow’s.

Harvest Now, Decrypt Later: the Quiet Risk Already Underway

One often overlooked reality is that encryption does not protect only the moment in which data is transmitted, it should protect the data’s entire “life”. Many forms of sensitive information remain valuable for decades: medical records, financial archives, intellectual property, contractual negotiations, and entire classes of governmental and corporate secrets. Even private citizens generate long-lived digital traces that could reveal patterns of behavior, identity, or personal history years after they are created.

This is where the harvest-now-decrypt-later (HNDL) risk becomes relevant. An adversary does not need a powerful quantum computer today to cause harm in ten years. They only need to capture encrypted traffic now, store it, and wait for quantum computers to mature. If a sufficiently powerful machine becomes available in a decade (a timeline that is entirely plausible given current progress) any encrypted data archived today using non-quantum-safe algorithms could become readable in the future. For certain categories of information, the damage of delayed decryption would be just as significant as a breach occurring immediately.

This explains why governments and large enterprises have already begun migrating toward quantu-safe cryptography. The urgency is not driven by what quantum computers can do today, but by what they might be capable of within the lifespan of the data we produce right now.

We Did Factor 49337 on a Quantum Computer — but Not in the Way That Matters

All of the above refers to a specific paradigm: the gate-based quantum computer, the type that runs quantum circuits and would eventually execute Shor’s algorithm at scale. These devices are the focus of nearly all discussions about quantum advantage and the potential threat to encryption.

However, gate-based systems are not the only form of quantum computing. A different architecture — the quantum annealer — operates according to a distinct physical principle. Rather than performing universal quantum computation, annealers are specialised machines designed to find low-energy solutions to optimization problems. They do not run Shor’s algorithm, and they do not provide exponential speedup for factoring. But they possess the scale that gate-based systems currently lack. Today’s quantum annealers include thousands of qubits and can operate in hybrid configurations that combine quantum sampling with classical computation, allowing them to tackle certain tasks of non-trivial size.

This is the context in which our experiment took place. To use a quantum annealer for factoring, the problem must be reformulated as an optimization task. Instead of searching directly for the prime factors of a number, we frame the challenge as minimising the expression:

\[(p⋅q−N)^2,\]

where N is the number we wish to factor, and p and q are chosen from a list of possible primes encoded within the optimization model. When the expression reaches zero, we have found valid factors.

Using this approach, the hybrid annealing system correctly identified:

\[
49337=103 * 479 \]

It even succeeded for numbers larger than this example.

Our claim is technically correct — the quantum computer did factor the number — but it does not imply any progress toward quantum cryptanalysis. The result depends critically on the list of primes supplied to the solver. A classical brute-force algorithm provided with the same list finds the solution immediately. And because the list is necessarily finite, the method contains blind spots.

For instance, if the list is:

\[primes\_subset=[2, 3, 5, 7, 9, 11]\]

the largest product available is 99, yet many smaller composite numbers — such as 26, 34 or 39 — cannot be represented because the primes 13, 17, and others have been cut off. As one attempts to factor larger and larger numbers, the number of missing combinations grows rapidly unless the list of primes is expanded correspondingly.

The conclusion is clear: factoring 49337 on a quantum annealer is a valid demonstration of quantum-assisted optimization, not a breakthrough in quantum factoring.

Why We Did It — and Why It Matters Anyway

The experiment was not intended to suggest that quantum annealers are approaching the capability to break encryption. The real purpose was to illustrate a fundamental point about quantum computing: what matters is not the size of the number factored, but the scalability and theoretical soundness of the method used. In the context of cryptography, an algorithm that factors 15 with provable exponential advantage is vastly more meaningful than one that factors 49337 with a heuristic, non-scalable approach.

Quantum computing is full of demonstrations that appear impressive but do not advance the core scientific or cryptographic milestones. This does not diminish their relevance — annealers are powerful tools for optimization and provide valuable insight into hybrid quantum-classical workflows, but it does highlight the importance of distinguishing between engineering demonstrations and genuine progress toward quantum advantage.

Understanding this difference is essential not only for evaluating research claims but also for interpreting the real state of the quantum threat to cryptography. The world does not need a quantum computer that breaks RSA today to be vulnerable; it only needs one to exist within the lifespan of the data being encrypted.

Furthermore, this should highlight that the largest number ever factored on a quantum computer is not a meaningful benchmark for evaluating the progress of the field. Despite major breakthroughs in error correction, modularity, and fidelity — which are metrics that truly matter — we are still stuck at factoring 15 when using a proper implementation of Shor’s algorithm. This may look like slow progress, but the exponential nature of quantum speedups makes the situation counter-intuitive: small improvements in the underlying technology can translate, within just a few hardware generations, into the ability to factor numbers far beyond today’s limits. What seems trivial now can become relevant much sooner than our linear intuition would suggest.