THE ESSENTIALS IN 30 SECONDS

  • Google DeepMind announced on November 6 that human-supervised AI agents found two weaknesses in legacy 1024-bit RSA, together with researchers from UC San Diego and Inria.
  • One result concerns forging padded signatures (a theoretical gain of about 1,600x in one hard case); the other cuts the average cost of factoring each extra key in a batch by about 30x.
  • No 1024-bit key was reported broken in the wild, and DeepMind says modern 2048-bit RSA is not affected; no paper was linked in the coverage.

Google DeepMind said on November 6 that AI agents, supervised by human experts, had uncovered two weaknesses in RSA with 1024-bit keys, a configuration that has long been considered too weak for real-world use. The work was announced by Pushmeet Kohli, DeepMind's vice president of science, and was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta with cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria), according to OfficeChai and Interesting Engineering.

The two results

The first concerns digital signatures. Padding is supposed to stop attackers from forging RSA signatures, but the researchers report that once an attacker controls roughly half of the signed block or more, it adds almost no protection. In a sandboxed test against a 1024-bit benchmark key from earlier academic work, the agents' implementation reproduced a known forgery using 3.5 times less CPU time, and with less than a thousandth of the computation needed to factor that key. For a harder case, where the attacker controls only a 32-byte message digest, the agents proposed a new algorithm that DeepMind estimates is about 1,600 times better than the previous best method. That figure is a theoretical estimate, not a measured attack.

The second result is about factoring many keys of the same size at once. Here the agents found a batch method with better asymptotic complexity than earlier techniques, which reportedly lowers the average cost of factoring each additional 1024-bit key by about 30 times.

What it does and does not mean

Neither report describes a 1024-bit key being broken in a live system, and DeepMind says RSA-2048, the size most modern deployments use, is unaffected. The company presents the work as evidence that AI agents can stress-test cryptographic assumptions far faster than human teams alone, and argues that the hardness of a scheme should be re-measured continuously rather than treated as fixed.

Important details remain unclear. The coverage links no paper or technical report, so the methods and cost estimates cannot yet be checked independently, and no disclosure process is described. Organisations most exposed are those still running 1024-bit keys in embedded devices, old certificate chains or other long-lived infrastructure.

For context, Heninger and Thomé are among the authors of a September 2026 ePrint paper showing that, with temporary access to a signing oracle, 1024-bit RSA signatures can be forged without factoring the key. The reports do not say whether that paper is the benchmark DeepMind used.