DeepMind Agents Find Two Weaknesses in Legacy 1024-Bit RSA

What happened

The announcement came on Nov 6 from Pushmeet Kohli, DeepMind's vice president of science, in a post on X and LinkedIn titled "Advancing the frontier of cryptanalysis": working under human experts, the team's agents produced two advances in cryptanalysis, with two technical papers published alongside. The work was led by Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria.

The first result targets digital signature forgery. When an attacker controls more than half of the signed block, padding stops adding protection, and forging a signature becomes nearly as easy as with no padding at all; in a sandbox, the agents reproduced a forgery of an already-solved 1024-bit benchmark key from earlier academic work using 3.5 times less CPU time, under a thousandth of the computing power needed to factor the key. Where the attacker controls only a small slice of the block, such as a 32-byte digital fingerprint, a new algorithm is theoretically about 1,600 times better than the previous best method — a theoretical estimate, not a measured result.

The second result targets factoring many keys of the same size in bulk. The new algorithm has better asymptotic complexity than previous batch methods, cutting the average cost of factoring each additional 1024-bit key by about 30 times, with the discount growing as the haul grows. Both experiments ran in a sandbox and broke no live keys; DeepMind says the results apply only to retired 1024-bit RSA, and modern 2048-bit and larger keys are unaffected by these findings.

Key facts

1. Announced by: Pushmeet Kohli, DeepMind's vice president of science, Nov 6, 2026, in a post on X and LinkedIn titled "Advancing the frontier of cryptanalysis"
2. Method: human-supervised AI agents, completing two advances within weeks; two technical papers published alongside
3. Team: led by Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria)
4. Signature forgery (large control): when an attacker controls more than half of the signed block, padding adds no protection
5. Signature forgery (measured): a sandbox forgery of a solved 1024-bit benchmark key reproduced with 3.5 times less CPU time, under a thousandth of the compute needed to factor the key
6. Signature forgery (theoretical): where the attacker controls only a small slice such as a 32-byte fingerprint, a new algorithm is theoretically about 1,600 times better than the previous best method
7. Batch factoring: the new algorithm's asymptotic complexity beats previous batch methods, cutting the average cost per additional 1024-bit key by about 30 times
8. Scope: only retired 1024-bit RSA is affected; modern 2048-bit and larger keys are unaffected
9. Conditions: the experiments ran in a sandbox and broke no live keys; online banking, messaging, software updates and digital currencies are not threatened
10. Background: the US National Institute of Standards and Technology (NIST) stopped accepting 1024-bit RSA for generating new signatures in 2013