Google DeepMind’s AI Agents Found Two Weaknesses in 1024-Bit RSA — 2048-Bit Keys Still Safe

Google DeepMind says its AI agents, guided by human experts, found two weaknesses in legacy 1024-bit RSA encryption — and did it in weeks. The announcement came on November 6 from Pushmeet Kohli, DeepMind’s VP of Science. Before anyone panics: the research affects only obsolete 1024-bit systems. Modern 2048-bit keys, the kind that protect your banking, messages and software updates, are not affected.

So what did the agents actually find, and how much do the headline numbers really mean? The details matter here, because the biggest figures in this story are estimates, not timed attacks on live systems.

What DeepMind announced

The work covers two separate results, published as two working papers: “Modular Roots from a Restricted Oracle” and “Fan Factories”. It was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, working with cryptographers Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria. Humans still directed the work while the models did much of the exploratory research.

DeepMind says it has published the full technical papers so the wider security community can check the results and build on them. The papers have not been peer reviewed yet, which matters for how to read the numbers that follow.

Weakness one: signature forgery

The first result concerns digital signatures — the mechanism that lets a computer verify that a message, software update or document genuinely comes from its claimed source. DeepMind’s agents found that protection depends on how much of the signed block an attacker controls. Once an attacker controls roughly half the block or more, padding stops adding meaningful protection, and forging a signature becomes nearly as easy as if there were no padding at all.

In a sandboxed test against an already-solved 1024-bit benchmark key from an earlier academic study, the agents’ implementation reproduced the result using 3.5 times less CPU time — and less than a thousandth of the computing power it would take to break the underlying key itself.

The headline figure comes from a harder case. When an attacker controls only a small part of the signed data, such as a 32-byte digital fingerprint, DeepMind says a new algorithm theoretically improves on the previous best method by about 1,600 times for 1024-bit keys. That 1,600x figure is a theoretical estimate from the maths, not a timed attack. Keep that distinction in mind.

Weakness two: batch factoring

The second result tackles a different angle: factoring many RSA keys at once. DeepMind’s agents discovered a new algorithm with better asymptotic complexity than any previously known batch method, cutting the average cost of factoring each additional 1024-bit key by about 30 times compared with earlier batch methods.

Nobody has built the “fan factory” this implies, and the 30x figure is again an estimate, not a measured attack on real keys. But the direction is clear: cracking a large batch of old 1024-bit keys at once just got cheaper on paper.

Why 2048-bit keys stay safe

DeepMind is careful on this point, and every report of the announcement repeats it: the results apply only to obsolete 1024-bit RSA systems. Modern encryption, which almost universally uses 2048-bit keys or larger, is unaffected. RSA-1024 has long been considered retired and unsafe for real-world use — NIST disallowed 1024-bit RSA for generating new signatures back in 2013 — which is exactly why researchers use it as a sandbox: a system complex enough to be meaningful, but safe to attack without touching anything live.

That is also why this research matters for the future rather than the present. AI agents that can do real cryptanalysis in weeks are a new tool for the security community, and the same methods will eventually be aimed at stronger systems. The lesson is not that your bank account is at risk today. It is that old crypto retires for a reason, and the retirement schedule keeps getting shorter.

What should you do?

For most people: nothing. If your systems already use 2048-bit keys or larger — and nearly everything modern does — this announcement changes nothing about your security. If you run old infrastructure, check whether any of it still relies on 1024-bit RSA keys or certificates, and retire them. That advice was already true before DeepMind’s announcement; the research just gives it fresh weight.

The bigger story here is the method. AI agents that can hunt for weaknesses in encryption, guided by humans, could speed up security research the same way they are speeding up coding. OpenAI’s GPT-6 Cyber already showed AI finding hundreds of real Linux kernel flaws, and Anthropic’s IPO is riding on the same wave of AI capability. The question is no longer whether AI can do security research — it is how fast the defenders can move once it does.