Curator's Take
This groundbreaking security audit reveals a sobering reality: the quantum computing simulator ecosystem that underpins virtually all quantum research is riddled with critical vulnerabilities, including a novel "QASM injection" attack that has no classical equivalent. The discovery that vulnerabilities can transfer from commercial frameworks into national laboratory infrastructure highlights how security flaws in quantum software could pose national security risks as the field matures. Perhaps most concerning is the identification of a consistent 32-qubit threshold where vulnerability chains become exploitable, suggesting that as quantum simulators scale to handle larger problems, they become exponentially more vulnerable to attack. This research underscores the urgent need for security-first development practices in quantum computing, especially as we transition from academic curiosity to mission-critical applications.
— Mark Eatherly
Summary
Quantum computing simulators form the classical software foundation on which virtually all quantum algorithm research depends. We present Broken Quantum, the first comprehensive formal security audit of the open-source quantum computing simulator ecosystem. Applying COBALT QAI -- a four-module static analysis engine backed by the Z3 SMT solver -- we analyze 45 open-source quantum simulation frameworks from 22 organizations spanning 12 countries. We identify 547 security findings (40 CRITICAL, 492 HIGH, 15 MEDIUM) across four vulnerability classes: CWE-125/190 (C++ memory corruption), CWE-400 (Python resource exhaustion), CWE-502/94 (unsafe deserialization and code injection), and CWE-77/22 (QASM injection -- a novel, quantum-specific attack vector with no classical analog). All 13 vulnerability patterns are formally verified via Z3 satisfiability proofs (13/13 SAT). The 32-qubit boundary emerges as a consistent formal threshold in both C++ and Python vulnerability chains. Supply chain analysis identifies the first documented case of vulnerability transfer from a commercial quantum framework into US national laboratory infrastructure (IBM Qiskit Aer to XACC/Oak Ridge National Laboratory). Nine frameworks score 100/100 under all four scanners; Qiskit Aer,Cirq, tequila, PennyLane, and 5 others score 0/100.