DeepMind's AI Found Two Cracks in 1024-Bit RSA — Your 2048-Bit Keys Are Safe

AI agents found two cracks in old RSA encryption

Google DeepMind said on 6 November 2026 that AI agents working under human supervision found two weaknesses in legacy 1024-bit RSA encryption, with a new signature-forgery method that DeepMind estimates is about 1,600 times better than the previous best method in theory, and a measured reproduction of an earlier attack using 3.5 times less computing time. RSA is a public-key encryption system whose security rests on how hard it is to factor very large numbers into their prime factors, and it still underpins much of the secure internet. The results apply only to obsolete 1024-bit keys. Modern systems, which almost universally use 2048-bit keys or larger, are not affected by these specific findings, and DeepMind said so plainly.

The announcement came from Pushmeet Kohli, DeepMind's vice president of science, in a post on X that pointed to two working papers published on 5 and 6 November 2026, titled "Modular Roots from a Restricted Oracle" and "Fan Factories". The work was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, working with cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. Neither paper has been peer reviewed. One fact keeps this story in proportion: RSA with 1024-bit keys is already retired. The US National Institute of Standards and Technology ended acceptance of 1024-bit RSA for generating new signatures in 2013, and banks, messaging apps and browsers moved to 2048-bit keys or larger years ago. DeepMind chose 1024-bit RSA as a test case precisely because it is already obsolete, a safe proving ground where a faster attack can be studied without putting live systems at risk.

Illustration created for INORYVA

What the AI agents actually found

The first finding concerns forging digital signatures. A digital signature proves that a message or a piece of software really came from who it claims to come from, and RSA signatures rely on a padding scheme called PKCS#1 v1.5. The padding is supposed to protect the key when an attacker can feed chosen data to a signing device, such as a hardware security module, and collect the output. DeepMind's agents found that once an attacker controls roughly half of the signed block or more, the padding adds no protection against forgery. The harder case is when the attacker controls only a small slice of the signed data, such as a 32-byte digital fingerprint like a SHA-256 hash. For that case the agents produced a new algorithm that, on DeepMind's theoretical estimates, improves on the best previously known forgery method by roughly 1,600 times for 1024-bit keys. Read that carefully: the 1,600x figure is a theoretical estimate about how the maths scales, and the paper states that the result was not run at this size. It is a claim about asymptotic behaviour, not a stopwatch reading from a real attack.

The second finding is about batch factoring, which means breaking many RSA keys at once rather than one at a time. The agents found a new algorithm with better asymptotic complexity than any previously known batch method, cutting the average cost of factoring each additional 1024-bit key by about 30 times compared with previous batch techniques. There is also a measured result, and it is the one with real computing time behind it. The agents reproduced an earlier 1024-bit computation from an academic study published in September 2026 by Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé, using 3.5 times less CPU time than the original team needed. The first root took 391 CPU core-years, and the work ran for 3.2 days from the start of full-scale sieving, on up to 300,000 CPU cores and 16 GPUs, against about five months for the previous computation. One agent generated the mathematical proofs and a second agent verified them in Lean 4, a formal proof system.

Headlines have mostly led with the 1,600x figure, and some have presented it as though an AI just broke encryption 1,600 times faster. That is not what DeepMind reported. The table below keeps the three figures apart, because they are three different kinds of claim.

Result	Figure	What it actually is
Signature forgery, short 32-byte fingerprint	About 1,600x better	Theoretical estimate for 1024-bit keys; not run at this size
Reproducing the earlier 1024-bit computation	3.5x less CPU time	Measured result; first root took 391 CPU core-years in 3.2 days
Batch factoring, each additional 1024-bit key	About 30x cheaper on average	Theoretical improvement in asymptotic complexity

Illustration created for INORYVA

Why it matters, and what you should do

If 1024-bit RSA is already dead, why does this research matter? The answer is about method, not about the keys. Cryptographic security has always rested on assumptions about how hard certain maths problems are, and those assumptions were made by humans, tested by humans, and revised slowly. DeepMind's work shows AI agents doing a meaningful part of that testing: exploring attacks, fixing their own errors, and producing proofs another agent can check. A research cycle that used to take months of expert work produced a reproduction in days. The same approach will not stop at 1024-bit keys, and every widely used encryption standard rests on hardness assumptions that could in principle be probed the same way. DeepMind's message is that those assumptions can no longer be treated as fixed.

There is a useful comparison inside INORYVA's own coverage: an AI scan found three Bitcoin Core bugs earlier this year, showing the same pattern from a different angle, with AI systems finding flaws in real software faster than expected. Read about that in our report on the Bitcoin Core vulnerabilities AI scan. The RSA work is different in one important respect: it is a deliberate attack on a retired standard in an isolated environment, not a flaw found in live software. DeepMind states directly that the results were obtained in an isolated environment and do not touch running systems. The papers do not claim to factor a 1024-bit key from scratch, and they claim nothing against 2048-bit keys. The agents did not break RSA in general.

For almost every reader, the honest answer to "what should I do" is nothing new. If your systems already use 2048-bit RSA keys or larger, or modern elliptic-curve cryptography, this research changes nothing about your security today. But it is a good prompt to check for the places where old keys hide, because 1024-bit keys still exist in forgotten corners: old embedded devices, legacy VPN setups, ancient certificates, and internal systems nobody has touched in years. Find out whether anything you control still uses 1024-bit RSA keys, including certificates, SSH host keys and signing keys for old software, and replace anything you find with 2048-bit keys or larger. Treat key size as something to review on a schedule, not once. And do not panic about quantum computers because of this story: this is classical AI-assisted cryptanalysis of a retired key size, not a quantum breakthrough.

The wider security lesson is the one DeepMind itself draws. Security teams should assume that attackers, including AI-assisted ones, will keep probing the assumptions behind today's standards, and the most urgent threats are usually ordinary supply-chain tricks, not exotic maths. The same week this research appeared, a tampered extension in a code editor marketplace tried to install a backdoor. Our report on the Cursor Claude Code extension malware explains how to check for the malicious key it installed. The same applies to the behaviour of the models themselves, covered in our explainer on the Claude rogue behaviour report. On the constructive side, the same capability can measure strength too, as in the cybersecurity benchmarks for Gemini 4 Carbon.

 

Illustration created for INORYVA

Key Takeaways

• Google DeepMind announced on 6 November 2026 that AI agents under human supervision found two weaknesses in legacy 1024-bit RSA, described in two working papers dated 5 and 6 November.
• The 1,600x figure is a theoretical estimate for signature forgery with a short 32-byte fingerprint, not a measured result, and it applies only to 1024-bit keys.
• The measured result is a reproduction of an earlier 1024-bit computation using 3.5 times less CPU time, with the first root taking 391 CPU core-years over 3.2 days.
• Batch factoring of additional 1024-bit keys is claimed to be about 30 times cheaper on average, as a theoretical improvement in asymptotic complexity.
• Modern 2048-bit and larger keys are unaffected, and 1024-bit RSA has not been accepted for generating new signatures since NIST's 2013 decision.
• Check for any lingering 1024-bit keys in old devices, certificates and signing keys, and replace them with 2048-bit keys or larger.

Conclusion

DeepMind's RSA research is a genuine advance in how fast cryptographic weaknesses can be found, and a reminder that no hardness assumption should be treated as permanent. It is not a break of modern encryption. The 1,600x number is theoretical, the measured number is 3.5x, and both stop at a key size the industry retired years ago. Retire any 1024-bit keys you still have, and keep your systems on 2048-bit keys or better.

Sources

• Pushmeet Kohli, Google DeepMind, announcement post on X, 6 November 2026, pointing to the working papers "Modular Roots from a Restricted Oracle" and "Fan Factories" (via reporting below)
• Interesting Engineering — Google DeepMind finds 1,600x faster way to expose encryption flaws, 6 November 2026: https://site-test.interestingengineering.com/ai-robotics/google-deepmind-agents-expose-older-encryption-flaws
• WebProNews — Google DeepMind's AI Agents Find Two Weak Spots in Legacy 1024-Bit RSA, 6 November 2026: https://www.webpronews.com/deepmind-ai-agents-legacy-1024-bit-rsa-weaknesses/
• Let's Data Science — Google DeepMind AI agents find faster attacks on legacy RSA-1024, 6 November 2026: https://letsdatascience.com/news/google-deepmind-ai-agents-find-faster-attacks-on-legacy-rsa-5d679013
• DEV Community — Google DeepMind: AI agents found two weaknesses in legacy 1024-bit RSA, 7 November 2026: https://dev.to/delimitter/google-deepmind-ai-agents-found-two-weaknesses-in-legacy-1024-bit-rsa-2d5d
• ExplainX — DeepMind 1024-Bit RSA Claim: What Is Actually Verified?, 6 November 2026: https://explainx.ai/blog/deepmind-ai-agents-two-weaknesses-1024-bit-rsa-claimed-vs-verified-2026l