Google DeepMind says AI agents found two weaknesses in old RSA encryption

Google DeepMind said this week that artificial intelligence agents, working under the supervision of human mathematicians, have identified two previously undocumented theoretical weaknesses in 1024-bit RSA encryption, an aging standard that was already considered too weak for serious use. The finding was disclosed on November 6 by Pushmeet Kohli, a vice president at Google DeepMind who leads the company's science and strategic-initiatives work, in a post on X. Neither DeepMind nor the independent cryptographers who worked on the project say the results threaten the 2048-bit and longer keys that protect online banking, messaging apps and most software updates today. But the work illustrates how quickly automated systems are narrowing the gap between theoretical attacks on cryptography and the raw computing power needed to carry them out.

What the AI agents found

The project was led by DeepMind researchers Krishnamurthy "Dj" Dvijotham and Abhradeep Thakurta, working alongside cryptographer Nadia Heninger of the University of California, San Diego, and Emmanuel Thomé of the French national research institute Inria. Their results appear in two preprints, "Modular Roots from a Restricted Oracle" and "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS," posted in early November and not yet peer-reviewed.

The first weakness concerns digital signatures. The researchers found that once an attacker controls roughly half or more of the data block being signed, the padding added before signing provides little additional protection, making forgery almost as easy as attacking an unpadded system. Even when an attacker controls only a small fragment, such as a 32-byte digital fingerprint, the AI agents produced an algorithm DeepMind's team estimates is theoretically about 1,600 times more efficient than the best previously known method against 1024-bit keys.

Rather than inventing an attack from nothing, the agents first reproduced an existing one. In September, a team of academic researchers published an IACR ePrint paper describing a signature-forgery attack on a 1024-bit RSA key that took about 1,380 CPU core-years spread over five calendar months and roughly 4.3 billion queries to a signing oracle — a result the paper's authors said was produced without AI assistance. According to DeepMind's account of its own work, its agents reran that same attack using about 391 CPU core-years of computation, finishing the heavy sieving stage in a little over three days with access to as many as 300,000 CPU cores and 16 GPUs — roughly 3.5 times less computing time than the original academic effort needed. One agent is reported to have produced the mathematical proof behind the faster method while a second checked its logic in Lean 4, a formal proof-verification language, catching and fixing errors along the way.

The second weakness involves factoring many RSA keys of the same length at once. The new algorithm, described in the "Fan Factories" preprint, is said to improve on earlier batch-factoring techniques enough to cut the average cost of factoring each additional 1024-bit key in a large batch by roughly 30 times. A related, independently authored cryptanalysis preprint on a similar oracle-based attack, posted to the same archive in October, cites the same September benchmark attack, underscoring how active this narrow corner of cryptography research became in the months before DeepMind's announcement.

Why an old standard still matters

RSA keys of 1024 bits have not been considered adequate for sensitive use for more than a decade. The National Institute of Standards and Technology's transition guidance, last revised in 2019, has long directed federal agencies and contractors away from 1024-bit RSA in favor of 2048-bit or larger keys. Despite that guidance, security researchers say shorter keys persist in older hardware security modules, aging virtual private network appliances, some embedded industrial controllers, legacy smart cards and a handful of digital-certificate and DNSSEC deployments that have been slow or costly to upgrade.

DeepMind's announcement extends a run of AI-assisted cryptanalysis work that has unfolded through 2026. In September, engineers at the AI coding startup Cognition used its Devin agent to build a GPU-based implementation of the classical general number field sieve and factor RSA-260, at the time the largest number factored in the open research record, with the company estimating that a well-resourced lab could factor a 1,024-bit modulus for roughly $30 million in cloud GPU time. Weeks later, an engineer used Anthropic's Claude model to factor RSA-896, another public factoring record, arguing that 1024-bit keys were coming within reach of organizations with large GPU fleets even as 2048-bit RSA remained untouched.

Limits, scope and reaction

Both of DeepMind's new results were produced and tested inside an isolated research environment against a benchmark key, not against any key protecting a live system, and the company was explicit that keys of 2048 bits or longer are unaffected by either finding. Early coverage of the preprints noted that both figures — the 1,600-times improvement in signature forgery and the 30-times reduction in batch-factoring cost — are theoretical estimates rather than demonstrated breaks of deployed infrastructure, and that even the faster reproduction still required hundreds of CPU core-years and specialized GPU access well beyond what most attackers could marshal.

"These results do not affect the security of modern encryption schemes such as RSA 2048," Kohli wrote, adding: "We must not assume the mathematical 'hardness' of cryptographic schemes."

Organizations most exposed are those that never completed the migration NIST recommended years ago: operators of older hardware security modules and signing infrastructure, device makers still shipping 1024-bit certificates on embedded products, and administrators of legacy VPN or code-signing systems that expose a raw signing interface to the keys in question. Coverage of the announcement noted that no outside cryptographers had yet published a formal critique of either preprint, consistent with how recently the papers were posted.

What happens next

Both papers remain unreviewed preprints, posted to an open archive where other cryptographers can scrutinize the proofs and attempt to reproduce the results — standard practice in a field where claims are routinely revised after peer review. Kohli framed the work as evidence that AI "can help defenders improve security standards well ahead of future threats," rather than as an emergency. For organizations still running 1024-bit RSA anywhere in their infrastructure, the practical advice from security researchers has not changed: finish the migration to 2048-bit keys or larger that NIST has recommended since the middle of the last decade, and treat this month's results as a reminder of why that advice existed in the first place rather than as a new threat to modern systems.