Arvind Krishna & Nikesh Arora: Quantum Threat, Open vs Frontier AI, AI Cyber Warfare & SaaS Collapse

Arvind Krishna said DARPA’s Quantum Benchmarking Initiative has narrowed from a few hundred companies to about 13, aiming to identify who can build a working quantum computer. He put the possible arrival of a machine capable of breaking today’s cryptography at 2028, 2029 or 2033, with 2030 as a midpoint, and called the threat real. He expects claims of quantum error correction on a running machine by next year, but said they need independent evaluation; he expects one or two companies to make progress by 2027, though not at scale. Current quantum gate-computation levels are around 10,000, he said, and a tenfold annual increase could reach 10 million by 2029. As an illustration, 10,000 physical qubits might produce 200 logical qubits.

Krishna said post-quantum cryptography has been developed, but organizations have been slow to adopt it. Its security depends on theoretical understanding and complexity assumptions rather than theorem-level proof, he cautioned. Because attackers may retain stolen encrypted data and decrypt it later, he urged organizations to start moving toward quantum-safe infrastructure; post-quantum-ready keys can protect traffic as a temporary measure while systems are replaced. He disagreed with the view, attributed to some senior AI researchers, that AI could enable cryptographic codebreaking before quantum computers: without quantum hardware, he argued, AI cannot deliver a quantum algorithm’s speed advantage. A classical approach such as predicting prime-number distributions might still be possible, but its usefulness would depend on whether it could break keys in a practical timeframe.

Nikesh Arora advised teams experimenting with AI to use the best model they can access easily, rather than first optimizing costs or building their own. For enterprise deployment, he said, model choice should fit the task: routine endpoint security can use compressed, task-specific small models, while a major breach could justify frontier models and agent swarms. He cited endpoint inspection costs of about $20–$25 per endpoint annually, with 20–40-megabyte payloads, and said a task-specific small language model could reach 90.9% accuracy. Arora expects many practical uses, including defensive systems, to rely on adapted open-source or open-weight models trained on proprietary data, with weights managed in-house. One estimate in the discussion put the cost of running an approximately 800-billion-parameter Chinese open-weight model on company GPUs at $1–$2 per million tokens, down from roughly $20–$50 after about a week of engineering, while doing about 95% of the work. In-house models can also protect chain-of-thought and other intellectual property, though the discussion noted that zero-data-retention terms may still permit providers to generate synthetic data.

The discussion estimated that Western open-weight models could match the best Chinese models within one or two years, with the current gap at six to twelve months, and predicted open-weight models could account for 75–90% of token users. Cost, intellectual-property concerns and the ability to operate models independently are drivers, but cheaper models are worth moving into production only where experiments show they can do the job. Arora said coding agents can improve models’ ability to find both good and bad code, while the security burden remains asymmetric: defenders must find and patch every vulnerability, but attackers need only one. In the Mythos example, he said the system hallucinated about 30% of the time and estimated that 60–80% of vulnerabilities identified in testing were real. Companies could share vulnerabilities with trusted parties, develop patches centrally and distribute them broadly.

Krishna said his organization uses coding agents for about half its code, which he considers better than before because agents evaluate it and fix detectable flaws before release. He expects agent-written code eventually to surpass human-written code, but warned that it will not be error-free: systems catch only flaws they know how to detect, and fully verifying correctness is computationally infeasible, especially with unrestricted inputs. Arora said companies remain responsible for released software, including agent-written code, and commercial providers have product-liability obligations. He also argued that unilateral slowdowns in AI development are unlikely to work if other countries can use the delay to catch up. Krishna said vertical integration matters most in strategically important areas: IBM still designs chips and much of its software, but no longer makes its own fabs, and can buy commodity components.

Arora argued that cyber customers should not have to assemble dozens of products, and that integrating strong category solutions on a platform can let their data work together, much as CRM moved toward unified platforms. He said cyber valuations had benefited from the AI Mythos event but expected them to rationalize. Arora also expects AI to disrupt SaaS over the next few years by changing product-market fit and making software more responsive to customer needs. Krishna said the average enterprise uses 500 to 5,000 software vendors and suggested AI could reduce that to 5 to 10 main platforms; consolidation could take six months or six years as falling software value makes separate distribution harder to justify. But interaction-rich software may be easier to replace than systems requiring very high reliability, such as retail-banking database lookups or closing books. Some organizations might need to run a digital twin for years before switching, Krishna said, raising the question of whether the change would deliver a cost advantage.