DeepMind AI agents find two weaknesses in 1024-bit RSA

The latest:

Two weaknesses in legacy 1024-bit RSA systems were identified by AI agents working under human supervision alongside cryptanalysis experts, Google DeepMind announced on 6 November 2026. Pushmeet Kohli, the company’s vice president for science, said the team reached both results in weeks and that modern encryption such as RSA 2048 is not affected. No production system was named as impacted.

Details:

• The team: DeepMind said the research was led by DJ Dvijotham and Abhradeep Thakurta, with Nadia Heninger of the University of California San Diego and Emmanuel Thomé of France’s Inria taking part. It was presented as a contribution to the cryptanalysis community, not a product release.
• First weakness: According to DeepMind, padding in digital signatures adds little protection against forgery once an attacker controls roughly half of the signed block or more. The finding concerns the legacy 1024-bit setting, not the padding schemes used with longer modern keys.
• The verification: The team tested the result in an isolated environment against a reference 1024-bit key already broken in earlier academic work. DeepMind said the agents’ implementation reproduced the outcome with 3.5 times less processor time, using under one-thousandth of the compute needed to factor that key.
• The 1600x figure: Where an attacker controls only a small portion, such as a 32-byte digital fingerprint, DeepMind said the agents found a new algorithm outperforming the best known method by about 1600 times for 1024-bit keys. The company described that as a theoretical estimate, not a measured result.
• Second weakness: DeepMind reported an algorithm for bulk key factorization with better asymptotic complexity than all known batch methods, cutting the average cost of factoring each additional 1024-bit key by roughly 30 times. That shift matters most where large numbers of legacy keys remain in use.
• DeepMind’s framing: Kohli said the results strengthen the case for continuously re-evaluating cryptographic assumptions as AI capability in advanced mathematics improves. DeepMind positioned the release as giving defenders better tools to measure encryption strength rather than as an offensive capability.
• The prior paper: On 20 September 2026 researchers from UC San Diego and Inria, including Heninger and Thomé, posted a paper on the IACR archive on forging 1024-bit RSA signatures, carrying out a forgery attack using a hardware security module as the signing device.
• The cost: That earlier attack consumed 1380 CPU core-years over five months and 2^32 queries, according to the paper. Its authors estimated RSA security in this model is 15 to 30 bits lower than factoring-based estimates suggest.

Background:

RSA key length sets the cost of breaking it. 1024-bit keys have been considered obsolete for years but remain embedded in older devices and systems, where replacement is slow. RSA 2048 is the current baseline, and DeepMind said it is unaffected by these results.

Between the lines:

The two findings cut in different directions. The padding result is an estimate for a single key; the batch result changes unit economics, lowering the marginal cost of each additional 1024-bit key by about 30 times. That combination matters less for any one target than for fleets of legacy devices still running old keys. DeepMind’s weeks-long timeline, with named academic co-authors, also frames AI agents as working cryptanalysts rather than demonstration tools.

What’s next

Watch whether DeepMind publishes the agents’ algorithms or implementations, whether the September IACR paper by Heninger and Thomé is updated with the new results, and whether any vendor announces a timeline for retiring 1024-bit keys.