Google DeepMind AI Agents Find Two Weaknesses in 1024-Bit RSA: What It Means for Your Security

Google DeepMind said on November 6, 2026, that its AI agents, working with human cryptographers, found two previously unknown weaknesses in 1024-bit RSA. The announcement came from Pushmeet Kohli, DeepMind's vice president of science, in an essay titled "Advancing the frontier of cryptanalysis." The results target a key size that security standards retired years ago, yet 1024-bit keys still sit inside older hardware, long-lived certificates, signed firmware, and mail systems nobody has updated.

What DeepMind says its agents found

The project paired AI agents with academic cryptographers. One model wrote the mathematical proofs, a second model checked them, and the analysis was formalized in the Lean proof assistant, according to summaries of the work. The research was led at DeepMind by Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria among the collaborators.

The findings were published as two working papers dated November 5 and 6, 2026: "Modular Roots from a Restricted Oracle," on signature forgery, and "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS," on batch factoring. Neither paper has been peer reviewed yet, and no independent replication had been published when the announcement went out.

Weakness one: forging signatures through the padding

The first result concerns padding, the extra structure wrapped around a message before it is signed, which makes forgery harder. DeepMind says the protection from padding largely disappears when an attacker controls part of the signed data. Where the attacker controls only a short 32-byte fingerprint, the agents produced an algorithm DeepMind estimates is around 1,600 times faster than the best published method.

That 1,600 figure is a theoretical estimate, not a measured run, and the distinction matters. The part that actually ran was a sandboxed reproduction against a 1024-bit benchmark key that an academic team had already broken in September 2026. Against that benchmark, DeepMind reports its agents used 3.5 times less CPU time than factoring the key outright. So the headline number describes a calculation, while the measured number describes a reproduction of a key that was already solved.

In plain terms, the first weakness means an attacker who can influence part of what gets signed could forge a signature far more cheaply than before, at least on paper. Forging a signature is different from recovering the private key. It lets someone create a fake signature that verifies as genuine, which can undermine signed software updates and authenticated documents.

Weakness two: factoring many keys at once for less

The second result is about economics. The number field sieve is the fastest known classical way to factor large integers. DeepMind's batch-factoring paper asks what happens when an attacker factors many RSA keys of the same size together and shares the expensive work across them. According to the authors, after a one-time precomputation equal to the cost of factoring one 1024-bit number, each further key can be factored at about one fifty-eighth of the cost. The authors describe that as roughly 30 times less than the best previous batch method.

The authors are clear about the limits of this claim. They stress that it is a leading-order theoretical estimate and that no implementation of the new method exists yet. The paper itself states that these are not running time predictions. In other words, the second weakness is a mathematical result about cost, not a working tool that anyone has run.

Why modern encryption is not affected

DeepMind says RSA-2048 and larger keys are not affected, and the batch-factoring paper repeats that statement in its abstract. NIST has not allowed RSA keys shorter than 2048 bits for new signatures since the end of 2013, so if your bank, email provider, or phone uses current encryption, it almost certainly uses 2048-bit keys or larger.

NIST finalized its post-quantum transition report, IR 8547, on October 27, 2026. According to reports, it deprecates 2048-bit RSA signatures after 2030 and disallows them after 2035, so the industry is already moving toward post-quantum cryptography.

Where 1024-bit RSA still hides

The reason this announcement still deserves attention is that retired does not mean gone. A key size can be retired from new deployments and still survive for years inside systems that were built when it was standard. Old devices, embedded systems, industrial controllers, and some mail and certificate setups still carry 1024-bit keys.

For organizations, the practical step is an inventory. Find out whether any certificate, key, or signed firmware in your systems still uses 1024-bit RSA, and retire it. Security teams can also check whether their vendors still ship products that sign updates with short keys, since a forged signature on a software update is the scenario the first weakness points toward.

What the results say about AI and security research

Beyond the cryptography, the announcement is a milestone for AI-assisted research. The agents produced these results in weeks, with one model proposing proofs and another checking them. That is a real capability, and a narrow one: the work was steered by human cryptographers, built on earlier academic results, and formalized with tools humans designed. It is not a story about an AI breaking encryption on its own.

The results also show how the security community will have to read AI research claims from now on. Two numbers can both be true and mean different things: a theoretical estimate of 1,600 times faster, and a measured 3.5 times less CPU time on a solved benchmark. For now, the sensible reading is the one DeepMind itself offers. Two weaknesses were found in a legacy key size. Modern keys are safe. Old keys should be retired.

Frequently Asked Questions

Does this mean my passwords or bank account are at risk?

No, not according to DeepMind. The results apply only to 1024-bit RSA, a key size retired for new signatures more than a decade ago. Modern systems use 2048-bit keys or larger, and DeepMind says those are not affected.

Has anyone actually broken a 1024-bit RSA key with AI?

Not in the sense of a fresh break. The agents reproduced a break of a benchmark key academics had already solved, using 3.5 times less CPU time. The larger figures are theoretical estimates, and the batch-factoring method has not been implemented.

What should I do about this as an ordinary user?

Very little, directly. Keep your devices and apps updated, since updates replace old certificates and keys. If you run a server or old hardware of your own, check whether anything still uses 1024-bit RSA and replace it.