DeepMind AI Agents Find Two RSA-1024 Flaws

Google DeepMind said on Friday, Nov. 6, that AI agents working under human supervision found two new weaknesses in legacy 1024-bit RSA encryption, cutting the computing budget needed to forge signatures and to factor batches of keys. DeepMind vice president Pushmeet Kohli announced the research in a post on X, stressing that modern keys of 2048 bits or more remain secure.

Key takeaways

• Once an attacker controls about half of a signed block, padding gives RSA-1024 signatures no extra protection against forgery, DeepMind says.
• A new signature attack is about 1,600 times better than the previous best method for a 32-byte fingerprint, by DeepMind's theoretical estimate; the measured gain on a solved benchmark key was 3.5 times less CPU time.
• A new batch-factoring algorithm cuts the average cost of each additional 1024-bit key by about 30 times.

What DeepMind's AI agents found in RSA signatures

Many signature standards add preset data, called padding, to fill a message out to a fixed-size block before signing. Cryptographers knew padding helps prevent forgery, Kohli wrote, but not how much it protects when an attacker can feed chosen inputs to a signing device.

The agents' answer was that what matters is how much of the signed block the attacker controls. At roughly half or more, "padding adds no protection at all," the post said. In a sandbox that touched no live systems, the agents' implementation reproduced a forgery on an already-solved 1024-bit benchmark key from an earlier academic study with 3.5 times less CPU time, using under a thousandth of the compute needed to break the key itself.

Forgery is harder when the attacker controls less of the block, such as a short 32-byte digital fingerprint. Even there, DeepMind said its agents found an algorithm roughly 1,600 times better than the previous best method for 1024-bit keys. That figure is a theoretical estimate, not a measured run.

Cheaper batch factoring of RSA keys

Because RSA keys share standard lengths such as 1024 or 2048 bits, an attacker can spread one large up-front computation across many keys. DeepMind said its agents found an algorithm with better asymptotic complexity than previous batch methods, lowering the average cost of factoring each additional 1024-bit key by about 30 times.

The work was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. DeepMind published two technical papers; the announcement did not mention releasing code, and no third party has yet reproduced the numbers.

Context: an old key size under fresh pressure

RSA-1024 has long been retired, which makes it a safe proving ground. Heninger and Thomé were already pressing on it: a preprint they co-authored with UC San Diego colleagues, posted to the IACR ePrint archive in September, forged 1024-bit RSA signatures using a hardware security module as the signing oracle. That attack took 1,380 CPU core-years over five months and about 4.3 billion (2^32) oracle queries, and the authors concluded RSA's real security in that setting is 15 to 30 bits lower than factoring-based estimates.

"Historically, major advances in this kind of work take years or decades," Kohli wrote, adding that AI can now probe those assumptions much faster. "We cannot treat cryptographic hardness as a fixed assumption." We recently covered how attackers ran agents that rebuilt their malware until scanners stopped catching it.

What's next

The practical exposure lies in old devices and firmware that may still use 1024-bit keys; DeepMind did not estimate how many remain. The findings add weight to NIST's IR 8547 roadmap for moving off quantum-vulnerable algorithms such as RSA, finalized Oct. 27. The next test is whether outside cryptographers confirm the 1,600x and 30x estimates.

FAQ

Is my 2048-bit RSA key at risk?

DeepMind says no. The results apply only to obsolete 1024-bit RSA, and modern protocols that use 2048-bit or larger keys remain secure.

What should security teams do?

Find and replace any remaining 1024-bit RSA keys, especially in signing devices and older firmware, and keep planning the move to post-quantum algorithms.

References

• Advancing the frontier of cryptanalysis — Pushmeet Kohli, Google DeepMind, on X (Nov. 6, 2026)
• Forging 1024-bit RSA signatures in nearly SNFS time — IACR Cryptology ePrint Archive (Sept. 2026)
• NIST IR 8547, Transition to Post-Quantum Cryptography Standards — NIST (Oct. 27, 2026)
• Google DeepMind finds 1,600x faster way to expose encryption flaws — Interesting Engineering (Nov. 6, 2026)