DeepMind AI Agents Find Two Weaknesses in Legacy RSA-1024

What DeepMind announced

Google DeepMind said on November 6 that its AI agents, working under human direction, uncovered two weaknesses in legacy 1024-bit RSA, the public key system that still sits inside some older devices, signing setups, and firmware. Pushmeet Kohli, who leads science at DeepMind, announced the work in a post on X, and DeepMind framed it as research into how AI agents can speed up the stress-testing of encryption.

The project was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, with cryptographers Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria. That pairing matters: Heninger and Thomé are among the researchers who, in September, published a hand-built attack that forged 1024-bit RSA signatures without factoring the key, at a cost of 1,380 CPU core-years. The new results come from the same research area, now with AI agents doing part of the search.

The two weaknesses, in plain terms

The first finding is about signature padding. RSA signatures normally add fixed, preset data to a message before signing it, and that padding has long been treated as a defense against forgery. According to DeepMind, once an attacker controls roughly half of the signed data block or more, padding adds virtually no protection, and forging a signature becomes no harder than attacking unpadded RSA. Even when the attacker controls only a small piece of the block, such as a 32-byte fingerprint, the agents found an algorithm that in theory improves on the best previous attack on 1024-bit keys by about 1,600 times.

The second finding is about batch factoring: attacking many RSA keys of the same size together so that expensive steps are shared. DeepMind says the agents' algorithm improves the asymptotic efficiency of this process and cuts the average cost of factoring each additional 1024-bit key by about 30 times compared with earlier batch techniques.

What was actually measured

Most of the headline numbers are estimates, so it helps to separate them from what was run. The 1,600x figure is a theoretical improvement, and the 30x figure describes asymptotic cost per extra key. The one measured result came from a sandbox test against an already solved 1024-bit benchmark from earlier academic work: the agents' implementation reproduced the result with 3.5 times less CPU time, using less than a thousandth of the computing power needed to factor that benchmark key. DeepMind points to two technical papers, but no code release has been mentioned, and no third party has reproduced the results yet.

Who should care, and who should not

DeepMind and the coverage are clear that modern encryption is not affected. Keys of 2048 bits or larger, the kind protecting online banking, messaging apps, software updates, and digital currencies, are outside the scope of these findings. If your phone, browser, and password manager are up to date, nothing here changes your daily security.

The people who should pay attention are those still running 1024-bit RSA, which has been deprecated for years but lingers in old hardware, embedded devices, and long-lived signing keys. The practical step is the same one cryptographers have recommended for a decade: find any remaining 1024-bit keys and replace them, and be wary of any signing system where an outsider can choose a large part of what gets signed.

Why AI-assisted cryptanalysis matters

The larger signal is speed. DeepMind's argument is that "we cannot treat cryptographic hardness as a fixed assumption," because AI agents can now explore attack ideas that once took years of specialist effort. Kohli said the results reinforce the need to continuously reassess cryptographic assumptions as AI improves. The researchers behind the September forgery made a similar point: their attack used no GPUs or AI tools, and they expected both to lower the cost of future attacks. For anyone who values private communication, the takeaway is to keep moving off old cryptography before cheaper attacks arrive, not after.