Google DeepMind says AI agents found two new weaknesses in legacy 1024-bit RSA

What Google DeepMind reported

Google DeepMind said on 6 November 2026 that its science team, working with AI agents under human guidance, had produced two cryptographic advances against RSA with 1024-bit keys in a matter of weeks. Pushmeet Kohli, the lab's vice president of science, announced the work under the title "Advancing the frontier of cryptanalysis". Coverage names DeepMind researchers Dj Dvijotham and Abhradeep Thakurta as leads of the project.

The first result concerns digital signatures. DeepMind says the agents designed a new algorithm for forging RSA signatures when an attacker controls only a small part of the signed data, such as a 32-byte fingerprint, and estimates that it improves on the best previously known attack by about 1,600 times for 1024-bit keys. DeepMind describes this figure as a theoretical estimate. The measured result is smaller: on a 1024-bit benchmark key already broken in an earlier academic study, the agents' implementation reproduced the forgery with 3.5 times less CPU time, and with less than a thousandth of the computing work needed to factor the key itself.

The second result is a batch factoring algorithm. When an attacker wants to factor many 1024-bit keys at once, DeepMind says the method lowers the average cost of each additional key by about 30 times compared with earlier batch methods. The full forgery paper, "Forging 1024-bit RSA signatures in nearly SNFS time", is posted on the IACR preprint server.

Who should worry

DeepMind is explicit that 2048-bit RSA, the size browsers, certificate authorities and most current software require, is not affected. Standards bodies including NIST have treated 1024-bit RSA as too weak for new use for more than a decade. The keys still matter because they survive in old systems: embedded devices, industrial controllers, legacy VPN appliances, archived signed documents and firmware signing set up long ago.

For those owners, the batch result is the more practical warning. Cheaper factoring per key means an attacker who collects many old public keys, for example by scanning the internet, pays less for each one broken. The forgery result matters where a 1024-bit key still signs data whose authenticity someone relies on. The response is the one security teams have been told to carry out for years: find remaining 1024-bit keys and replace them with 2048-bit or larger RSA, elliptic curve keys or post-quantum schemes.

AI as a cryptanalysis tool

The wider claim is about speed. DeepMind presents the work as evidence that AI agents can stress-test cryptographic assumptions much faster than before, and that hardness estimates long taken for granted may need rechecking. It is the latest in a series of AI labs reporting results that used to take specialist teams months, such as Microsoft Research's agent-assisted proof of the KLS conjecture and OpenAI agents validating 948 Linux kernel root flaws.

The work was guided by human researchers, and its headline number is theoretical, so it does not show an AI system breaking modern encryption on its own. The independent review of the IACR paper by cryptographers is the next step, and it will show whether the 1,600 times estimate holds up. Other open questions are whether the techniques extend to larger keys in any meaningful way, which DeepMind's announcement does not claim, and whether Google will release the agent tooling or only the papers. The announcement does not say. More AI security research is on the cybersecurity page.

Questions people ask

Did Google DeepMind break RSA encryption?

No. It reported faster attacks on legacy 1024-bit RSA in specific settings. DeepMind says 2048-bit RSA, the current minimum in most software, is not affected.

What does the 1,600 times figure mean?

It is DeepMind's theoretical estimate of how much better its signature forgery algorithm is than the previous best attack when an attacker controls a 32-byte fingerprint. The measured speedup on a benchmark key was 3.5 times.

What should organizations using 1024-bit RSA do?

Find the remaining 1024-bit keys and replace them with 2048-bit or larger RSA, elliptic curve or post-quantum keys, as standards bodies have advised for years.

Sources

1. Advancing the frontier of cryptanalysis (Google DeepMind (Pushmeet Kohli), 6 Nov 2026)
2. Google DeepMind finds 1,600x faster way to expose encryption flaws (Interesting Engineering, 6 Nov 2026)
3. Google DeepMind's AI agents expose two weaknesses in legacy 1024-bit RSA (Crypto Briefing, 6 Nov 2026)
4. Google DeepMind Says It Has Used AI Agents to Break Legacy RSA-1024 Encryption Faster Than Anyone Thought Possible (OfficeChai, 6 Nov 2026)