DeepMind AI agents find two weaknesses in old 1024-bit RSA
Google DeepMind says human-guided AI agents found two weaknesses in legacy 1024-bit RSA. One cut a known signature forgery computation from 1,380 to 391 CPU core-years, the other makes batch factoring of many keys much cheaper on paper. Modern 2048-bit RSA is not threatened.
On 6 November 2026, Google DeepMind shared two cryptanalysis working papers in which AI agents, guided by human researchers, attacked legacy 1024-bit RSA. The author list includes DeepMind's Dj Dvijotham, Pushmeet Kohli and Abhradeep Thakurta together with the well known cryptographers Nadia Heninger and Emmanuel Thomé. DeepMind is clear on one point: systems that use 2048-bit RSA or larger are not threatened by these results.
The three things you need to know
1. The signatures. The first paper looks at an attacker who can get a signing device to sign chosen data for a while and later wants to forge signatures alone. The team shows that for the common PKCS#1 v1.5 format, the padding stops adding any difficulty once the attacker controls more than half of the signed block. In practice, the agents reran a 1024-bit computation that other researchers published earlier: with the same algorithm and parameters, the first forged root took 391 CPU core-years instead of 1,380, about 3.5 times less. Two cooperating AI agents designed, ran and debugged it in under four days, while the human researcher sent about twenty short messages, most of them approvals.
2. The batch attack. The second paper, called fan factories, targets the case where someone wants to factor many keys of the same size. After a precomputation that costs about one normal factorization, each further 1024-bit key would cost about 1/58 of a standard number field sieve run, 30 times less than the best comparable method from 1993. This is a leading order estimate under standard assumptions. The algebra was checked in Lean 4, but nobody has built a fan factory yet.
3. The catch. 1024-bit RSA has been considered too weak for new signatures for more than a decade, yet such keys still survive in older devices and systems. Both papers are working papers and have not gone through peer review.
Why it matters
Cryptography rests on assumptions about how hard certain math problems are. If AI agents can move a slow field forward in weeks, those assumptions need to be tested more often. The practical message is simple: anything that still depends on 1024-bit RSA should be on a migration list now.
Dany's take
This is not "AI broke encryption", and anyone who says so is selling clicks. What it shows is more interesting: two agents did months of expert engineering in days with almost no human input. Today that hits legacy keys. The question is how long the safety margin on today's standards really is.
Sources
Source: Google DeepMind