Cloudflare's research team published a plan on November 6 for carrying Privacy Pass, the token system Cloudflare uses to rate-limit traffic without tracking the people behind it, into the quantum era. A site accepts the token instead of making a visitor solve a puzzle or log in, and the token cannot be traced back to whoever earned it. Cloudflare says one goal of the next generation is better handling of AI agent traffic that would otherwise crowd out human visitors, which puts this research squarely inside the bot-management decisions you are making now.

My first reaction was a question I suspect many technology leaders share. Where is this quantum future coming from? Quantum chips are still being built, and no machine today can break the encryption that protects your bank login. The hardware is not here yet, yet Cloudflare's 2029 target sits about one hardware refresh, or one multiyear security contract, away from late 2026.

I wrote this week about Cloudflare's third-quarter results, where security and AI drove the growth. This post sits underneath that story, in the cryptography your anti-bot controls depend on.

Forged Tokens Are the Quantum Risk, and They Arrive on Q-Day Itself

Most post-quantum warnings focus on attackers who record encrypted traffic today and decrypt it once a quantum computer exists. Privacy Pass does not carry that risk. The protocol is private by mathematical design, so even a quantum attacker could not link a token to the person it was issued to, today or in 2030. A quantum attacker could counterfeit the ticket but still could not tell who bought it.

Forgery is a different story. Privacy Pass relies on the RSA algorithm and elliptic curves, and a large enough quantum computer could break both. On that day, an attacker could mint tokens at will and walk past the rate limits and bot checks built on them.

That timing explains why Cloudflare is re-engineering the protocol now. The risk lands on a single day instead of building up in recorded traffic, and the fix has to be in place before that day. Cloudflare's researchers wrote in April that vendor dependency chains turn this kind of migration into a multiyear effort, which means the replacement has to clear standards bodies, browsers and your own vendors well ahead of the hardware.

A quantum attacker could counterfeit the ticket but still could not tell who bought it.

The Hardware Gap Is Closing Faster Than Planners Assumed

Labs on Earth already cool quantum processors to a few hundredths of a degree above absolute zero, so temperature is no longer the barrier. Scale is. Breaking today's cryptography still needs a large, error-corrected machine that does not exist, though recent estimates of how large have fallen sharply.

Those estimates are why Cloudflare moved its target for full post-quantum security up to 2029 in April (Cloudflare, 2026). The company pointed to new work from Google showing elliptic-curve cryptography could fall to a smaller quantum computer than researchers had assumed, and to an estimate from the quantum startup Oratomic of about 10,000 physical qubits to break the common P-256 curve on a neutral-atom machine (Cloudflare, 2026). Cloudflare writes that Google appears concerned about Q-Day arriving as soon as 2030, and that the chief technology officer of IBM Quantum Safe cannot rule out targeted attacks on high-value systems as early as 2029.

Cloudflare has already moved the encryption half of the job. More than 65% of human traffic to its network uses post-quantum encryption (Cloudflare, 2026). Proving that a visitor is legitimate is the harder half, and Privacy Pass is part of it.

MOLE Lets an AI Agent Prove It Is Trusted Without Saying Who Vouched for It

Cloudflare calls the next-generation design MOLE, for Moderation Of unLinkable Endorsements. Trusted parties called anchors vouch for a client, and the client proves to a moderator such as Cloudflare's edge that one of the trusted anchors vouched for it, without revealing which one.

One type of Privacy Pass token reveals its issuer, and sometimes that is the point, as when a token proves a client may use a customer's VPN. For many uses, though, a site only needs to know that someone it trusts vouched. MOLE hides the issuer for those cases, so every client vouched for by a trusted anchor gets the same treatment. Cloudflare says the goals include better tools for agent traffic and letting more kinds of clients take part. It says it is collaborating with others on this, and it points readers to work Mozilla has published on anonymous credentials for the web.

For an enterprise running customer-facing agents, this design points toward a future where your agent proves it is trustworthy without your company's identity riding along on every request. The Internet Engineering Task Force, the standards body that formalized Privacy Pass, will decide how much of MOLE becomes a shared standard.

Quantum Safety Costs Kilobytes, and Cloudflare Thinks the Bill Is Payable

Post-quantum cryptography is bulky. The new federal signature standard from the National Institute of Standards and Technology, the Module-Lattice-Based Digital Signature Algorithm or ML-DSA, produces signatures of 2,420 bytes, against 64 bytes for the elliptic-curve signature it replaces (Cloudflare, 2026). Privacy Pass also needs a blind signature, where the issuer signs without seeing what it signed, and ML-DSA does not provide one.

Cloudflare builds on a blind signature called PoMFRIT, published this year at 6.7 kilobytes and built from signature schemes that rest on systems of quadratic equations. Cloudflare estimates that swapping in a related scheme brings it to 4.3 kilobytes (Cloudflare, 2026). By Cloudflare's comparison, replacing today's RSA blind signatures with PoMFRIT costs about as much as replacing elliptic-curve signatures with ML-DSA, a cost the industry has already accepted for regular web connections.

The two MOLE candidates are larger. Cloudflare estimates 6.5 kilobytes to redeem an endorsement and 12.0 kilobytes to spend a credential, with public keys of 46.6 kilobytes (Cloudflare, 2026). Each operation runs in a few milliseconds in the code Cloudflare published on GitHub, and Cloudflare says the numbers may change as analysis continues.

If the numbers hold, the authors write, the work moves from cryptography design to protocol engineering. A token that costs several kilobytes cannot ride along on every request the way today's tokens do, so the protocol will need to spread one redemption across many requests.

Cloudflare Lists Its Own Open Problems

The post is candid about what still needs proof. Researchers have studied this family of quadratic-equation cryptography for less time than lattice-based methods, and Cloudflare expects its parameters to change as review continues. PoMFRIT's size gains also rest on a stronger security assumption than the underlying signature scheme, which Cloudflare says needs more study.

Cloudflare points to a recent case that shows why the margin matters. Researchers at the University of California, San Diego and the French research institute Inria forged a 1024-bit RSA signature by using a Privacy Pass issuer as a signing oracle. Privacy Pass uses 2048-bit RSA along with other defenses, and Cloudflare notes that a break of this kind would let an attacker forge tokens while users stayed anonymous.

This is the Cloudflare I have come to expect: protection-first and open about the limits of its own work. I hope more vendors start their post-quantum engineering this early and describe the unfinished parts as plainly.

What Happens Next

• Will the Internet Engineering Task Force take up post-quantum token types for Privacy Pass in time for Cloudflare's 2029 target?
• Will browser and operating system makers adopt MOLE's issuer-hiding model for agents and people alike?
• Will outside review of these quadratic-equation schemes settle their parameters before quantum hardware closes the gap?