Google DeepMind’s AI Agents Found Two Cracks in Legacy 1024-Bit RSA — Modern Encryption Is Safe
Key takeaway: Google DeepMind announced on November 6, 2026 that AI agents under human supervision found two weaknesses in legacy 1024-bit RSA encryption: a cheaper way to forge certain signatures and a cheaper way to factor many old keys at once. Modern 2048-bit keys are unaffected, DeepMind says — a warning about old cryptography, not a break of today’s encryption.
What happened
Pushmeet Kohli, Google DeepMind’s vice president of science, announced the research on November 6, 2026, in a post titled “Advancing the frontier of cryptanalysis.” The work was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, working with cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. The findings are described in two working papers, “Modular Roots from a Restricted Oracle” and “Fan Factories,” published November 5 and 6. Neither paper has been peer reviewed yet.
RSA is the public-key encryption system behind much of the internet’s security — it protects website connections, software updates, and digital signatures. The 1024-bit version is an older, weaker form that the industry has been moving away from for years. The US standards body NIST stopped accepting 1024-bit RSA for generating new signatures back in 2013, but the old standard still lingers in some legacy devices, old signed firmware, and systems that were never upgraded.
Finding 1: Forging signatures got cheaper
The first result concerns digital signature forgery. DeepMind’s agents worked out exactly when the padding used in RSA signatures stops protecting them: once an attacker controls roughly half of the signed block or more, padding adds little meaningful protection, and forging a signature becomes nearly as easy as if there were no padding at all.
To check the finding, the team reproduced a forgery against an already-solved 1024-bit benchmark key from earlier academic work — a September 2026 paper by researchers at UC San Diego and Inria that first demonstrated 1024-bit RSA signature forgery. The agents’ version used 3.5 times less CPU time than the original computation, and less than one-thousandth of the computing power it would take to factor the underlying key itself.
For harder cases — where an attacker controls only a small slice of the signed data, such as a 32-byte digital fingerprint — the agents produced a new algorithm that DeepMind estimates is theoretically about 1,600 times better than the previous best method for 1024-bit keys. That 1,600x figure is a theoretical estimate, not a measured result, and the distinction matters.
Finding 2: Factoring many keys at once got cheaper
The second result attacks a different angle: factoring many RSA keys in bulk. DeepMind’s agents found a new algorithm — described in the “Fan Factories” paper — with better asymptotic complexity than any previously known batch method. It cuts the average cost of factoring each additional 1024-bit key by about 30 times. That matters because attackers rarely target one key: if the cost of breaking each extra key drops sharply, a large collection of old keys becomes a much softer target than any single key would be on its own.
1024-bit RSA vs modern encryption: what actually changed
| What | 1024-bit RSA (legacy) | 2048-bit RSA and larger (modern) |
|---|---|---|
| Signature forgery | Cheaper: 3.5x less CPU in the measured test; up to ~1,600x better in theory for short inputs | Not affected by these specific findings, DeepMind says |
| Batch factoring | ~30x lower average cost per extra key | Not affected by these specific findings |
| Status | Retired; NIST stopped accepting it for new signatures in 2013 | Current standard for most systems |
| Where it still appears | Old devices, legacy firmware, unpatched systems | Banking, messaging, software updates, digital currencies |
Why it matters — and what to do about it
The headline numbers sound alarming, but DeepMind is explicit about the limits: these results apply only to obsolete 1024-bit RSA, and the experiments ran in isolated environments, not against live systems. Online banking, messaging apps, software updates, and digital currencies are not threatened, because they use 2048-bit keys or stronger.
The real story is different, and arguably more important. AI agents did in weeks what would previously have taken human cryptographers far longer — finding a sharper answer to a known problem and a genuinely new algorithm for batch factoring. That is a preview of how AI will change security research: the same techniques that probe old weaknesses will be aimed at current ones. Defenders get faster tools, but so do attackers, and the gap between “theoretically breakable” and “practically broken” keeps shrinking.
For IT teams, the practical step is concrete: find any 1024-bit RSA still in use — especially in signatures on firmware, old certificates, and legacy appliances — and plan its retirement. If a system cannot be upgraded, isolate it. The same week, OpenAI launched GPT-6 Cyber, a hacking model restricted to vetted defenders — the industry is clearly betting that AI-assisted offense and defense will both accelerate from here.
Knowns, unknowns, and what to watch
Known: AI agents under human supervision found two concrete advances against 1024-bit RSA, with measured and theoretical figures published in two working papers. Modern 2048-bit keys are unaffected by these specific findings.
Unknown: The papers have not been peer reviewed, and independent cryptographers have not yet reproduced the results. The 1,600x figure is a theoretical estimate, and no code has been released, so the practical speed of these attacks outside DeepMind’s setup is unconfirmed.
What to watch: Peer review and independent reproduction of both papers; whether the techniques extend toward 2048-bit keys (DeepMind says these specific findings do not); and how quickly vendors cite the work in migration guidance for legacy systems. Security teams should also watch for the same agent-assisted approach being applied to other legacy cryptography, as the tampered Claude Code extension incident showed how fast AI-tool supply chains can become attack surface.
Analysis: the headline is not the story
Analysis — this section is our assessment, not DeepMind’s claims. The “1,600x faster” headline will travel further than the caveats, and it will be misread. Nothing here breaks the encryption protecting your bank account or your messages. What it breaks is the comfortable assumption that old cryptography is merely old — that a retired standard sitting in a forgotten device is harmless because breaking it was too expensive to bother with. DeepMind’s agents just made “too expensive” a moving target. The sensible response is not panic but housekeeping: retire 1024-bit RSA wherever it still hides. Google’s own research arm keeps pushing that frontier — Gemini 4 Carbon, its newest frontier model, is gated to cyber defenders — and the defenders’ head start depends on acting on findings like this one before attackers weaponize them.
Frequently asked questions
Does this mean my passwords and bank account are at risk?
No. The findings affect only legacy 1024-bit RSA, an encryption standard that has largely been replaced. Modern systems use 2048-bit keys or larger, and DeepMind says those are unaffected by these specific results. Your bank, messaging apps, and software updates use the stronger modern standard.
What is 1024-bit RSA, and why is it still around?
RSA is a public-key encryption system used to secure connections and verify digital signatures. The 1024-bit version was the standard years ago, but NIST stopped accepting it for generating new signatures in 2013 because computers got fast enough to threaten it. It still survives in old devices, legacy firmware, and systems that were never upgraded.
How did AI agents actually help with this research?
Human cryptographers directed the work, while DeepMind’s AI agents did the exploratory mathematical and computational tasks — searching for sharper answers and new algorithms. The agents found a precise condition for when signature padding stops protecting RSA, and a new batch-factoring algorithm. The work was done in weeks, with the results written up in two working papers.
What should IT teams do now?
Audit for any 1024-bit RSA still in use, especially in signatures on firmware, old certificates, and legacy appliances, and plan its retirement. If a system cannot be upgraded, isolate it from sensitive networks. The findings do not require emergency action on modern systems, but they do shorten the safe lifetime of any legacy cryptography still in production.
Sources
- Interesting Engineering — “Google DeepMind finds 1,600x faster way to expose encryption flaws” (November 6, 2026)
- AI Frontier Post — “DeepMind’s AI agents found two cracks in legacy 1024-bit RSA — and modern keys are untouched” (November 7, 2026)
- Dev.to — summary of DeepMind’s two working papers, “Modular Roots from a Restricted Oracle” and “Fan Factories” (November 7, 2026)
- Mundo IA — “Google DeepMind uses AI agents to investigate the security of cryptographic systems” (November 6, 2026)
