Can large language models (LLMs) safely run quantum experiments?

June 27, 2026

As artificial intelligence continues to advance, large language model (LLM) agents are increasingly capable of writing and executing experimental control code. This suggests a path towards fully autonomous "self-driving" laboratories, but raises a critical operational challenge: How can researchers give an AI the freedom to write its own native code without risking damage to highly sensitive and expensive quantum hardware?

To address this challenge, researchers from the Duke Quantum Center and the National Quantum Laboratory (QLab) have developed a novel control system that safely places an LLM agent in the loop of trapped-ion experiments. The new preprint, titled "A hardware-safety-gated system for LLM-written native ARTIQ control code on a trapped-ion platform" (arXiv:2606.27231), details a framework that establishes a formal, per-operation boundary between human authorization and autonomous agent decisions.

The research team includes Duanyang Wang, Lu Qi, Yuanheng Xie, Norbert M. Linke, and Kenneth R. Brown.

Building a safe boundary for AI autonomy

In modern trapped-ion and neutral-atom laboratories, the advanced real-time infrastructure for quantum physics (ARTIQ) stack is often used to handle real-time device abstraction, precise nanosecond timing, and experiment scheduling. The researchers integrated the LLM agent to control the ARTIQ stack using tools provided by a model context protocol (MCP) server.

To give the agent maximum creative freedom while ensuring physical safety, the team implemented a strict "safety-filter" proxy:

Autonomous magnetic-field compensation by an LLM agent — Top: Without compensation, the Ramsey coherence of the trapped-ion qubit suffers a rapid collapse (around 180 µs) due to 60 Hz power-line-synchronous magnetic-field noise. Bottom: The LLM agent's compensation scheme successfully suppressed the 60 Hz noise, restoring the coherence time to approximately 1.5 ms.

No tool call is permitted to reach the hardware unless it possesses an authorization token bound exactly to its contents.
Tokens can be issued manually by a human operator for highly sensitive actions.
Tokens can also be issued automatically by running the agent's proposed script through an isolated hardware simulation to verify every operation against preset safety bounds before execution.

Autonomous experiments and calibration on live hardware

Operating securely within this safety boundary, the LLM agent developed its own experiments dynamically, rather than relying solely on pre-built routines.

The system was deployed on live trapped-ion experiments - a co-trapped 40Ca+/40CaOH+ crystal at the Duke Quantum Center and a 171Yb+ ion-trap at QLab. The AI agent autonomously constructed a complete calibration stack. This included writing and successfully executing control code for Doppler cooling, 729 nm spectroscopy, sideband cooling, and Rabi flopping.

In an example of autonomously developed calibration results, the agent worked alongside targeted operator guidance to close a cross-instrument magnetic-field-stabilization loop. The agent successfully coupled ARTIQ-based Ramsey interferometry with an external arbitrary waveform generator (AWG) to create an active magnetic-field compensation system. This allowed it to effectively suppress 60 Hz power-line-synchronous magnetic-field noise.

Red-teaming the safety filter

**Outcome of the adversarial campaign.** *(a)* Classification of the 1,932 generated scripts according to the safety filter's response during the red-team evaluation. The control set of legitimate calibration scripts is approved without a single false rejection, while every unsafe or disallowed request is correctly blocked. The remaining approvals lie along the characterized system boundary, divided between deliberate divisions of responsibility (where protection relies on the operator's configuration or stated policy) and open residual gaps. Scripts that pass initial syntax checks but cannot be evaluated by the simulation are recorded separately as they place no demand on the filter's protection. *(b)* Detailed breakdown and categorization of the blocked requests and filter responses across the adversarial test suite.

To probe the robustness of their safety measures, the team conducted an extensive "red-team" campaign against the developed system. By systematically attacking the filter with over 1,900 adversarial bench scripts, they mapped the precise empirical boundary of the system's protection and established a layered plan for future security hardening.

Furthermore, the team analyzed the situations where the AI still required human intervention. They discovered that the agent's limitations primarily lie in "metacognitive control" - recognizing when an experimental problem needs to be conceptually reframed - rather than a lack of domain knowledge.

By successfully bridging the gap between LLM autonomy and hardware safety, this work marks a significant step toward the realization of secure, self-driving quantum laboratories.

Read the full preprint on arXiv: https://arxiv.org/abs/2606.27231