An Ethlabs view on post-quantum and post-AI timelines: pqai27

November 11, 2026 · published on Ethereum Magicians

This is Ethlabs' view on post-quantum and post-AI timelines and how we think Ethereum's protocol layer should prioritize them, after spending a week with coredevs at Devcon.

#tl;dr

• We think Ethereum can become post-quantum and post-AI in 2027: pqai27. This will future-proof Ethereum's leading position as the credible decentralized root of trust for the global economy, with ETH as the programmable store of value at its center.
• Being post-quantum is not enough, we intend on being post-AI too. AI capabilities are taking off: quantum timelines are moving forward, AI is solving open maths problems that pose the question whether some cryptographic primitives might break, and it’s finding software vulnerabilities at scale.
• Ethereum is uniquely positioned for this moment and leading the way: years of prior research and work have produced a clear plan to become post-quantum and post-AI, and now we should make it the priority. The network is resilient through its decentralized validator set and client diversity, and formal verification is already deeply embedded into its core development process.
• pqai27 means rethinking upcoming hardforks, including Hegotá: anything not on the critical path to pqai should be reconsidered. We will withdraw quick slots from Hegotá and commit to dedicating our resources to pqai27.

#AI timelines are accelerating

AI capabilities are arguably on an exponential take-off and as a result we see several threats to all forms of computing accelerating:

• Quantum timelines keep moving forward: the US government moved its goal for dealing with quantum risk from 2035 to 2030, and Google now aims to be post-quantum by 2029.
• AI is solving long-standing open maths problems in the hundreds, and the security of our cryptography is itself an open maths problem. Unlike with quantum, we don’t know whether a break even exists at all. While consensus is that it is unlikely, there's a non-zero risk that is hard to put a date on.
• Cyber capabilities are taking off just as quickly: OpenAI found and patched ~1000 vulnerabilities in Linux with their internal frontier model. All software will come under the same kind of scrutiny, sooner or later.

Ethereum not only needs to be post-quantum (pq) but also post-AI (pai). By post-AI we mean two things:

1. An Ethereum with cryptography that holds up against potential cryptanalysis findings.
2. Clients hardened against frontier models that find bugs at scale, leveraging formal verification and further leaning into Ethereum's unique client diversity.

You don’t have to believe in any single one of these threats. What has changed is that it has become much harder to reason when any of them will arrive. Even at today’s levels AI is accelerating all of them, and new models keep arriving every other month. You only need to believe in the trajectory of AI capabilities to understand the best time to future-proof the network is now.

#Ethereum’s opportunity: post-quantum and post-AI in 2027

Bringing post-quantum and post-AI Ethereum forward to 2027 will require shifting priorities at the protocol layer (more on this in following sections), and a collective focus. We think it’s worth it now for two reasons:

1. Maximum resilience through pqai will be the killer feature in times of unprecedented cyber capabilities. Ethereum’s strength is its security and the fact that it never stops running. With attacks on software taking off, security and uptime will be more in demand than ever. We think that Ethereum should double down on this strength and take the opportunity to be the reliable root of trust for users, app devs, and institutions alike. Significantly, this primary focus does not mean that everything else stops. Glamsterdam ships as planned, and the scaling it enables continues afterwards. Frames is on the critical path to pqai27, and it makes accounts more usable well beyond post-quantum signatures. Work in the layers above the core protocol is not affected.
2. Now is the cheapest time to commit. A pivot later, when we are deep into shipping the currently planned fork, would be far more costly than today. And because none of these threats can be conclusively dated, the question of whether to move pqai forward would come back with every new model or new finding. Committing to pqai27 means we answer it once, and everyone can plan around it.

Ethereum is uniquely well placed to respond to this moment in time.

• There already exists a clear path for Ethereum to be post-quantum and post-AI (pqai). Ethereum has years of pq work to build on, with a dedicated post-quantum team and a cryptography team at the EF, and annual post-quantum workshops at Cambridge University. The planned cryptography is built around hash functions, to minimize the assumptions we need to rely on. This is also the approach for the rest of the cryptography, such as aggregation. Minimal assumptions address both quantum computers and AI alike, so the existing plan already covers the cryptography for both.
• pqai27 means pqai-ready in 2027, and pqai-scaled as the stretch goal. The EF had already moved post-quantum resistance from 2029 to 2028, to leave a margin before quantum computers capable of breaking cryptography could arrive at the earliest. At the L1 days before Devcon in Mumbai, it became clear that there is now a path if core devs make it the highest priority. It’s worth distinguishing two levels:
  1. pqai-ready: Consensus is post-quantum and every user has a post-quantum route for their account, while Ethereum keeps running at the scaled capacity delivered by Glamsterdam. Should today's cryptography break earlier than expected, Ethereum can switch over and keep running at reduced capacity.
  2. pqai-scaled: Ethereum runs at full capacity with pqai transactions and blobs. This includes the scale enabled after Glamsterdam. This is a stretch goal for 2027.
• Ethereum's principled path will pay off, especially now.
  • Frontier cyber capabilities will find bugs in every client, and hardening them all will take time. In the meantime client diversity means that a bug in any single client need not cause major failures for the network. No other blockchain ecosystem has this property!
  • Formal verification is very quickly becoming a standard practice in how software is built and Ethereum has led its emergence for years. The EF is proving zkEVMs correct, and FV is spreading to the rest of the protocol: EthLib, the fast confirmation rule and next consensus protocol are formally verified.

#Practical considerations: rethinking Hegotá

We think the first and most important decision for coredevs is whether to make Ethereum post-quantum and post-AI in 2027, and that everything else should be worked backwards from this outcome. The timeline is ambitious, but during the week at Devcon, with many coredevs in one room, we saw what’s possible.

Committing to this goal means that anything not on the critical path to pqai-readiness has to be reconsidered, whether it is PFI, CFI or already SFI. As Potuz argues, anything not strictly needed will delay the fork.

Some of the key hardfork scoping decisions on the path to pqai27 are:

• FOCIL. While currently Hegotá headliner on the CL, we think it should only be scheduled in a way that pqai27 remains achievable. Many of us have co-authored the EIP and argued for its inclusion in even earlier hardforks, but (1) it slows down pqai-readiness and (2) open questions around its practical pqai-compatibility, either with EIP-8288 or with the PQ version of our current consensus protocol, Gasper, and (3) without FOCIL, the execution layer can ship Frames early, unburdening work on the consensus layer to ship a post-quantum consensus protocol.
• Frames + other pq account EIPs. Frames are already scheduled as headliner for Hegotá and on the critical path for pqai27. There might be lighter variants of frames but in broad strokes the plan is unchanged here.
• pq decoupled consensus or pq Gasper is the biggest open question: making the current consensus protocol, Gasper, post-quantum is plausibly the easier change and scoping work has already started. But it is less clear how many compromises that takes, and at what point it is easier to switch directly to decoupled consensus, which is the desirable end state and where a lot of progress was made recently, for example on aggregators and incentives. More work to be done in assessing this.
• Signature aggregation (EIP-8288) and pq DA (EIP-8479). Both are needed for the "at scale" part of the target. There is a clear story for migrating to pq-resistant objects:
  • Once pqai-ready is achieved, users can migrate to pq-secure accounts and make pq-enabled transactions, albeit at a higher cost due to their increased footprint. L2s can be pq-secure by using the calldata from pq-enabled transactions.
    • Note that there is no requirement for rollups to switch to pq-secure calldata, but this offers a fallback if required by new results breaking classical cryptography assumptions.
  • Once pqai-scaled is achieved, users can make pq-enabled transactions at the scale of non-pq transactions. L2s can consume pq-secure blobs directly.

In summary, a rough sketch of our current thinking for pqai27:

• Hegotá: pqai-ready Ethereum. From this point on, Ethereum can keep running safely no matter what, at reduced capacity if necessary. This includes data availability: while blobs are not post-quantum, rollups can fall back to calldata, and today's blob throughput fits into regular blocks, albeit at higher inclusion cost.
  • [EL] Hegotá: Frames with a pq signature scheme (SPHINCS) + pq account EIPs. Usually the execution layer and the consensus layer upgrade together in one hardfork. Without FOCIL, none of these changes depend on the CL, so the EL can ship them on its own as soon as they are ready, without waiting for pq consensus.
  • [CL] Hegotá: pq consensus (either Gasper or decoupled consensus). The CL can start working on pq consensus, without consideration for EL hardfork timelines. This is a large undertaking and will take longer. If pq-dc is chosen, the CL specs need to be finalized still, and client teams may use this time to (1) harden their clients, and (2) start with networking work.
• I*: pqai-scaled Ethereum at full capacity for L1 and DA. Post-quantum DA replaces the calldata fallback, and signature aggregation lets transactions with pq signatures run at full capacity.
  • Likely recouple the CL and EL to being a shared hardfork: pq DA + EIP-8288 (+ possibly FOCIL already).
• Outside of the hardfork schedule:
  • Users
    • Migration to pqai-secure accounts, including tooling and wallet support, with a clear story for an orderly migration.
    • This is an opportunity to onboard users to more featureful accounts, leveraging the Frames affordances. Such features harden accounts at a time of stronger AI capabilities, and include rotating keys, decoupling recovery keys from execution keys, creating scoped access to the account, and more, without needing to rely on third party tools and services.
  • Validators and clients
    • Give client teams dedicated time and resources to harden their clients with and against frontier models.
    • Validator pre-registration and migration to pq keys, including tooling requirements and support for different setups (institutional, home staking etc).
    • Advocate for a better distribution of client diversity to further strengthen network against certain failure modes in case of client bugs.

#What this means for quick slots, and what comes after

Reaching pqai27 is an ambitious undertaking that requires Ethereum to come together behind one collective goal. Hence we will withdraw quick slots from Hegotá and dedicate our resources to pqai27. We don't take this decision lightly. We pushed for quick slots because our survey showed that the community clearly wants them, and we are ready to defend this decision to the people who trusted us to deliver them. We continue to believe in quick slots and will work towards quicker slots in 2028.

You might ask what changed for us from a couple of weeks ago. For one, AI timelines are accelerating beyond what not long ago felt far, far away still. In January, when FOCIL and Frames were initially scoped for Hegotá, the frontier model was Opus 4.5. Exponentials are hard to grasp and the progress since then has been dizzying, as we are seeing it ourselves first-hand.

pqai27 is an opportunity for Ethereum to further stand out. Our ambition is for Ethereum to be the root of trust for the global economy. That rests on Ethereum being the most secure and credible place to settle value. Becoming pqai is hard and ambitious, much like The Merge. But AI is also enabling core development to move faster than ever: the new consensus protocol was formally verified within weeks, and the cryptography benchmarks are improving by the day thanks to auto-research. Being pqai will be table stakes and Ethereum has to keep getting more useful on top of it. Moving pqai to 2027 changes the order of the roadmap but by the end of 2028 we want Ethereum to be post-quantum, post-AI, but also faster, more censorship resistant and more useful to its growing set of users.

ETH will be a pqai store of value btw :)

Read and discuss on Ethereum Magicians →