Google DeepMind says AI agents found two weaknesses in legacy 1024-bit RSA encryption, and one of them makes forging digital signatures about 1,600 times more efficient than the best previously known attack. The research, announced on November 6, 2026, was guided by human cryptanalysts Nadia Heninger, affiliated with UC San Diego and Inria, and Emmanuel Thomé of Inria. DeepMind says the agents reached both advances in just weeks, work that used to take experts years.
The work was led on DeepMind's side by Dj Dvijotham and Abhradeep Thakurta. The announcement comes from DeepMind and its collaborators, and the findings have not been independently peer-reviewed. The details below come from DeepMind's summary as relayed by CryptoBriefing and Interesting Engineering, because no published paper was available to review.
What the 1024-bit RSA weakness means in practice
The first finding targets signature forgery. DeepMind's summary says it makes forgery against short-digest 1024-bit RSA about 1,600 times more efficient than the previous best known attack. Signing systems rarely sign an entire document. They sign a hash, a fixed-length digest of the data, so the size of that digest shapes how hard the attack is.
According to Byteiota, the 1,600x figure applies where an attacker controls only a small part of the signed data, such as a 32-byte hash. That is a narrower condition than a blanket break of every signature.
The second finding cuts the marginal cost of batch-factoring additional 1024-bit keys by about 30 times. Batch factoring attacks many keys at once, so once the setup cost is paid, each added key becomes far cheaper to break. The figure appears in the November 7 AI Daily Digest on GitHub, which summarizes the DeepMind announcement.
The caveats matter as much as the headline numbers. DeepMind calls the 1,600x figure a theoretical improvement over the best prior attack. Its validation ran in a sandbox against an already-solved RSA-1024 benchmark key, where the system reproduced the earlier result using 3.5 times less CPU time. That is a benchmark result, and the practical threat to live 1024-bit deployments remains unclear.
The pattern may matter more than any single number. Human experts set the direction, and the AI agents did much of the searching, according to DeepMind's framing.
Which keys are exposed and which are not
| Key size | Status in DeepMind's statements |
|---|---|
| 1024-bit RSA | Affected by both findings |
| 2048-bit RSA | Reported as unaffected |
| Larger than 2048-bit RSA | Reported as unaffected |
Pushmeet Kohli, DeepMind's vice president of science, wrote in an X post that "While these results do not affect the security of modern encryption schemes such as RSA 2048," which places the line at 2048 bits. DeepMind's announcement, as quoted by Digg, put the core finding this way: "Guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems."
The 1024-bit standard has been largely replaced by 2048-bit or longer keys. Legacy 1024-bit keys still persist in embedded devices, old certificate chains and long-lived infrastructure, according to the DEV Community digest. Byteiota lists the affected groups as US organizations running legacy VPNs, firewalls, hardware security modules, IoT fleets and enterprise certificate pools with 1024-bit keys.
Readers with 2048-bit or larger keys do not need emergency action based on this research, according to DeepMind's statements. Everyday users have no direct action indicated. The research does not show that the encrypted services people use daily are broken.
How to check your systems for 1024-bit RSA keys
Start with an inventory. Many 1024-bit keys sit in places nobody tracks, so the search should extend well beyond public web servers.
- Inventory certificates, keys and appliances across web servers, load balancers, VPN gateways, firewalls, hardware security modules and IoT devices.
- Check a public HTTPS endpoint from a terminal with OpenSSL:
openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -text | grep "Public-Key" - Check certificate files you already have with
openssl x509 -in cert.pem -noout -text | grep "Public-Key". A line reading "Public-Key: (1024 bit)" means the key is 1024-bit RSA. - Embedded devices and appliances may not expose their certificates to a command-line check. Use vendor documentation and firmware release notes to confirm key sizes, and ask vendors for a timeline to 2048-bit or larger keys.
- Replace 1024-bit keys where you find them, and plan migration toward post-quantum standards. According to Encryption Consulting, NIST's post-quantum standards include ML-KEM and ML-DSA, and migration guidance recommends adopting them now.
Why the RSA migration clock is already running
The timing matters separately from this research. In 2025, Google Quantum AI researcher Craig Gidney estimated that RSA-2048 could be broken by a quantum machine with fewer than one million noisy qubits in under a week, as The Quantum Insider reported. That estimate is a projection, not a working machine.
A secondary source, a ColorTokens blog post, cites NIST's draft transition guidance. It says the agency proposes deprecating RSA-2048 and similar algorithms after 2030, and disallowing quantum-vulnerable public-key cryptography after 2035. Those dates should be checked against NIST's draft directly before they go into a compliance plan.
Organizations that already moved to 2048-bit or larger keys gain room to plan. Operators of older appliances, where keys are baked into firmware and replacement cycles run for a decade, have the most work ahead. They now face AI-driven pressure on classical keys today and a quantum timeline with deadlines attached.
AI-assisted attacks are no longer a theoretical concern for security teams. USA 24 has reported on a China-linked group that used AI agents to probe more than 200 organizations, and OpenAI has released GPT-6 Cyber to vetted defenders.
What to watch next
- Peer review. The findings have not been independently peer-reviewed, and the claims should be read with that in mind.
- The full paper. One source gives the title "Forging 1024-bit RSA signatures in nearly SNFS time" and places it on IACR. That title has not been confirmed by a second source.
- Tooling. It is unclear whether DeepMind will release its algorithms or tooling. No source in the reporting says it will.
- Federal and critical systems. The sources do not address how much 1024-bit RSA remains in federal agencies and critical infrastructure. That gap determines how urgent this is for most US readers.
The next steps are fairly predictable. Expect cryptographers to test the 1,600x figure against real signing deployments, and expect vendors to publish advisories for devices that still ship with 1024-bit defaults. If the results hold up, the inventory work done this month will determine which teams replace keys on their own schedule and which replace them in a hurry.
