Google DeepMind says its AI agents, working under the direction of human cryptographers, have found two weaknesses in legacy 1024-bit RSA encryption — and the results arrived in a matter of weeks, not the years such cryptanalysis usually takes. The announcement, made on November 6, 2026, is less a warning about your bank account than a demonstration of how fast AI-assisted research is now moving through problems that once defined entire careers.
The headline is reassuring: modern RSA keys of 2048 bits and larger are not affected. The two findings target 1024-bit RSA, a key size that standards bodies retired for new signatures more than a decade ago but that still survives in older hardware, long-lived certificates, and embedded systems. The US National Institute of Standards and Technology has disallowed 1024-bit RSA for generating new signatures since 2013. The question is not whether the internet is broken — it is how much cheaper breaking the oldest parts of it has just become.
What DeepMind Actually Announced
DeepMind described the work as AI-assisted research rather than autonomous discovery. The agents probed RSA’s mathematical assumptions under human direction, guided by cryptographers who set the problems and checked the results. The research was led at DeepMind by Krishnamurthy (Dj) Dvijotham and Abhradeep Thakurta, working with Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria. Pushmeet Kohli, DeepMind’s vice president of science, set out the findings in posts on X, and the team published a working paper on the batch-factoring result titled “Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS,” dated November 5, 2026.
Two results, different in kind. The first concerns digital signatures — the mechanism computers use to confirm that a software update, a document, or a website really comes from its claimed source. The second concerns factoring many keys at once. Neither result breaks a single 1024-bit key faster than the general number field sieve, the method that remains the yardstick for RSA strength. What changed is the cost of specific attacks around the edges.
The Signature Weakness: Padding Is Not the Protection You Think
An RSA signature is not computed over the raw fingerprint, or hash, of a message. The fingerprint is first embedded in a padded block, and that padding was long assumed to add security. DeepMind’s agents showed that the padding gives no protection once an attacker controls about half of the signed block — and they produced a forgery method for short 32-byte fingerprints that the team estimates is about 1,600 times faster than the previous best method.
That 1,600x figure is a theoretical estimate, not a measured break. What was actually reproduced in a sandbox is more modest but still striking: against a 1024-bit test key already attacked in an earlier academic study, the agents’ code repeated the forgery with 3.5 times less CPU time than the original attack, using less than a thousandth of the computation needed to factor the key. The original study — a September 2026 preprint by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé — forged signatures by impersonating a hardware security module without extracting the key, using 1,380 years of single-core computing spread over five months and about 4.3 billion queries to the device.
The practical meaning is narrow but real. Forging a signature requires an attacker who can influence part of the data being signed, which is not the case in most everyday uses. But in systems where signed data is partly attacker-controlled — some firmware update flows and hardware security module deployments, for example — the safety margin just got thinner. The work also matters because the agents found the improvement in weeks. Cryptanalysis at this level has historically been a multi-year human effort.
The Factoring Weakness: Breaking Many Keys Gets 30 Times Cheaper
The second result is about economics. Factoring — recovering a private key from a public one — is the classic way to break RSA, and the general number field sieve is the standard tool for it. Factoring one 1024-bit key remains enormously expensive. But DeepMind’s “fan factories” method changes the arithmetic when many keys of the same size are attacked together.
With a one-time precomputation equal to the cost of factoring a single 1024-bit number, each further 1024-bit key can be factored at about one fifty-eighth of that cost — roughly 30 times less than with the best previous batch method. The idea builds on work from 1993, when Don Coppersmith described the original “factorization factory” concept, and extends it with multiple number fields. The authors stress that this is a leading-order theoretical estimate and that no implementation of the new method exists yet.
For an attacker, or a defender modelling one, the implication is that the cost of compromising a fleet of legacy devices is no longer the cost of breaking each key separately. A single large shared computation could, in theory, unlock many keys at a fraction of the per-key price. That changes the risk calculation for organisations still running 1024-bit RSA across large numbers of devices, even if no individual key is suddenly easy to break.
Why Your 2048-Bit Keys Are Safe — and Why Legacy Systems Still Need to Move
DeepMind is explicit on this point, and the working paper repeats it in its abstract: modern deployments based on 2048-bit and larger RSA are not threatened by either result. The attacks were tested only in a sandbox on an already-solved benchmark key, and no live systems were touched. If you use a modern browser, a current operating system, or a cloud service, these findings do not change your security today.
The systems that should pay attention are the ones that never got the memo from 2013. Old hardware security modules, industrial control equipment, legacy VPN appliances, and embedded devices with long-lived certificates can still carry 1024-bit keys — and they are exactly the systems that are hardest to patch. The November 2026 wave of exploited vulnerabilities — spanning Zyxel, WordPress, and Apple products — showed how quickly unpatched flaws get used in the wild. For them, the message is the same one the industry has been repeating for a decade, now with a sharper edge: inventory your keys, find the 1024-bit ones, and retire them. Breaches keep proving the point: the Chainalysis breach exposed password hashes and live tokens, a reminder that credential material is a prime target once a weakness is found.
This is part of a larger pattern. Governments are already treating cryptography as a moving target: Japan’s ¥10 billion emergency cybersecurity package, announced the same week, funds an AI “top gun” team and a public-private cyber rescue force. AI is now on both sides of the equation — Tencent’s Hy4 defensive AI model trains for defence rather than attack, and OpenAI’s GPT-6 Cyber, an AI security model focused on Linux exploits, shows defenders arming themselves the same way. The same week also pushed post-quantum migration further up the agenda, as the industry plans the move beyond RSA altogether.
What Happens Next
Three things are worth watching. First, whether the wider cryptography community validates the theoretical estimates once the full papers are public — some independent analysts have already noted that the primary announcement text has been hard to locate, so the claims should be read as reported until the papers circulate widely; one analysis separates the reported claims from what the public record confirms. Second, whether the signature-forgery technique generalises beyond the benchmark key it was demonstrated on. And third, whether the speed of this work — weeks, under human direction — becomes the new normal for cryptanalysis, compressing the time defenders have to respond to each new result. A detailed analysis of the announcement lays out both findings and their limits, and the story was reported on November 6 as the news broke.
The deeper story is not that RSA is broken. It is that AI agents have joined the cryptanalysis lab as capable junior researchers, able to explore mathematical terrain at a pace humans cannot match alone. AI security tools such as GPT-6 Cyber are already reshaping how defenders hunt for flaws, and the same pattern is now visible in security research: humans set the direction, machines do the searching, and results that once took years arrive in weeks. For defenders, that means the window between a weakness being found and it being exploited keeps shrinking. The fix for 1024-bit RSA has been available since 2013 — migrate to 2048-bit or larger keys, and plan the move to post-quantum cryptography. The only thing DeepMind changed is the urgency.
The Bottom Line
Google DeepMind’s AI agents found two genuine weaknesses in legacy 1024-bit RSA: a signature forgery method that is theoretically far faster for short fingerprints, and a batch-factoring technique that could cut the cost of breaking many keys at once by about 30 times. Both results are theoretical or sandbox-only, both leave 2048-bit RSA untouched, and both come with the caveat that the full papers are still making their way into public view. But they are a clear signal. The cryptography that protects the oldest corners of the internet is getting cheaper to attack, and AI is accelerating the pace at which new weaknesses surface. If your organisation still runs 1024-bit keys anywhere, the time to find them is now — not when the next announcement lands.
