Google DeepMind: AI Agents Find Two Weaknesses in 1024-Bit RSA, Leaving RSA 2048 Unaffected
Two working papers from Google DeepMind, alongside Inria and UC San Diego, describe AI agents that improved attacks against 1024-bit RSA, an obsolete format: padded signatures and batch factorization. The authors emphasize that keys of 2048 bits and above are not under threat.
Google DeepMind presented two cryptanalysis working papers on November 6, 2026, in which AI agents supervised by researchers improved known attacks against 1024-bit RSA. This format is obsolete: both texts emphasize that systems deployed using 2048 bits or more are not threatened. Among the authors are Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria), two renowned specialists in the field.
First Result: When Padding No Longer Protects
An RSA signature often appends fixed-format padding to the message prior to signing. The first paper investigates an attacker who can have chosen data signed for a period of time, and must subsequently forge new signatures on their own. Conclusion: with the PKCS#1 v1.5 format, as soon as the attacker controls more than half of the block (or a 64-byte digest at 1024 bits), this padding adds no difficulty whatsoever. With a 32-byte digest, the problem remains harder, but the authors lower its theoretical cost; DeepMind translates this gain into a factor of roughly 1,600 at 1024 bits—an estimate rather than an executed computation.
The practical side is a reproduction: on a 1024-bit instance already solved in a previous study, using the same algorithm and the same parameters, the computation took 391 CPU core-years, 3.5 times less than the original. According to the paper, two cooperating AI agents designed, launched, and debugged this computation in under four days, within an isolated environment and without touching any real-world systems.
Second Result: Factoring Many Keys at Once
RSA keys use standardized sizes. An attacker targeting many keys of the same size can amortize part of the workload. The second paper introduces “fan factories”: after a precomputation costing roughly one factorization, each additional 1024-bit key would cost approximately 1/58 of a traditional factorization, or 30 times less than the best comparable method known since 1993. This is a leading-order estimate under the customary heuristics of such analyses; the algebraic identities were verified in Lean 4, but no implementation has been built. Without precomputation, the reported speedup remains marginal.
Our take
This should not be read as “RSA is broken”: nothing here affects the 2048-bit keys in use today, and the most dramatic speedups are theoretical. The real takeaway lies elsewhere. On one hand, AI agents conducted a major research computation end-to-end, from coding to debugging, in just a few days. On the other, mathematical results were generated and then machine-verified. For security teams, the practical takeaway is straightforward: the remaining 1024-bit RSA keys still in service, along with signatures where an attacker controls a large portion of the signed data, warrant faster retirement. More broadly, security margins estimated a decade ago could begin shifting faster than before.
Sources
- Google DeepMind — Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation (working paper, PDF) Primary source
- Google DeepMind — Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS (working paper, PDF) Primary source
- Google DeepMind on X — announcement (November 6, 2026) Primary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
