AI News · 5 min read
DeepMind AI agents find two weaknesses in legacy 1024-bit RSA
Google DeepMind's human-guided AI agents found two weaknesses in obsolete 1024-bit RSA. What was measured, what is estimated, and why 2048-bit is safe.
What DeepMind announced on November 6, 2026
Google DeepMind's VP of Science, Pushmeet Kohli, published Advancing the frontier of cryptanalysis ↗ as an X article on November 6, 2026, and the @GoogleDeepMind account ↗ shared it the same day. The claim: AI agents, guided by human researchers, found two weaknesses in legacy 1024-bit RSA. Two working papers back it up: Modular Roots from a Restricted Oracle ↗ (signatures) and Fan Factories ↗ (batch factoring). Interesting Engineering ↗ and others covered it independently.
The work was led by Dj Dvijotham and Abhradeep Thakurta, with cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria).
The first thing to know is the limit. In Kohli's words, "these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure."
Result 1: padding stops helping once an attacker controls half the block
Many signature schemes add fixed "padding" before signing. DeepMind says that once an attacker who can feed inputs to a signing device controls roughly half of the signed block or more, the padding "adds no protection at all." The paper spells this out for the PKCS#1 v1.5 format used by the PKCS#11 CKM_RSA_PKCS signing mechanism: more than half a block of caller data, or a 64-byte digest, at 1024 bits.
Measured: in a sandboxed run on a 1024-bit benchmark key an academic team had already broken, the agents reproduced the forgery with 3.5x less CPU time. The working paper puts it at 391 CPU core-years for the first root versus 1,380 in the original study, using the same algorithm and polynomials. The authors call the 3.5x gain one of implementation.
Estimated: when the attacker controls less, such as a short 32-byte digest, DeepMind says a new algorithm improves on the previous best method by roughly 1,600x for 1024-bit keys "according to our theoretical estimates." That number was not run end to end.
Result 2: cheaper factoring when you attack many keys at once
RSA keys come in standard sizes, so an attacker can spread one big precomputation across many keys. DeepMind says its agents found a method that cuts the average cost of factoring each additional 1024-bit key by about 30x compared with earlier batch methods. This one is theoretical. The paper says each further integer costs about 1/58 of a standard number field sieve run after a precomputation of one run, 30x less than the older MNFS method. That holds "under the standard heuristics of NFS analyses," and the algebraic identities were proved in Lean 4. No "fan factory" has actually been built (Neural Brew ↗).
What people are saying on X
DeepMind's own framing (@GoogleDeepMind ↗):
"While modern 2048-bit systems remain safe from these specific exploits, this work highlights a key shift. As we enter a new era of AI-enabled math and computation, we can no longer rely on historical hardness assumptions and must continuously stress-test cryptographic standards."
Kohli's thread (@pushmeet ↗):
"Working with leading cryptanalysis experts, our team showed how AI agents could make two significant cryptographic advances in just weeks"
A practical reading of the batch result (@nxtday ↗):
"DeepMind is careful to say 2048-bit RSA stays secure. The batch result matters for anyone still running legacy 1024-bit keys: a roughly 30x lower average cost per additional key means attacking many keys at once gets far cheaper."
And the bigger pattern (@stretchcloud ↗):
"Two frontier labs have now pointed a model at real cryptography and gotten results trained human reviewers missed. At this point that's not a coincidence, it's starting to look like a method."
Our take: who should care
Most people: nobody's bank login just broke. Websites and modern SSH keys use 2048-bit RSA or larger, or elliptic curves, and DeepMind says outright that 2048-bit and up is not threatened. Ignore any headline that implies "AI broke encryption."
Security and platform teams: treat this as an inventory task. The real exposure is the long tail: old 1024-bit keys still sitting in embedded devices, internal signing services, HSM setups and legacy certificates. That's especially true where an untrusted caller can push chosen data into a raw signing interface. Find those keys, replace them with 2048-bit or larger, and stop exposing raw signing to callers you don't control.
Why it matters for AI tools: the interesting part isn't RSA-1024, which has been retired for years. It's the workflow. The signatures paper says the 1024-bit computation was "designed, implemented, optimized, run and debugged by two cooperating AI agents". A supervisor model wrote the design and audited results, and an executor model wrote the code and ran the jobs. The human researcher sent "about twenty short messages, most of them approvals." The agents wrote about 33,500 lines of code and finished in 3.2 days on up to 300,000 CPU cores and 16 GPUs, against about five months for the earlier study. The paper credits that gap mainly to parallelism. The factoring paper says one model generated the proofs and a second verified them. That's the same agentic pattern that coding tools are racing to sell, now aimed at research math. It fits a busy week for AI-in-security news. OpenAI's GPT-6 Cyber launched to vetted defenders, and Claude Code users learned their approval file can leak secrets.
Our caution: the 1,600x and 30x numbers are estimates in working papers that haven't been peer reviewed yet. The only number measured end to end is the 3.5x CPU saving on a key that was already broken. Repeat the big multipliers only with that context.
For how Gemini, Claude and ChatGPT compare as everyday tools, see ChatGPT vs Claude vs Gemini. If you build agents yourself, start with our AI agent frameworks comparison.