Google DeepMind's AI Agents Found Two Weaknesses in Legacy 1024-bit RSA: What Was Measured, What Is Theory, and Why 2048-bit Is Safe

What Google DeepMind announced on November 6, 2026

On November 6, 2026, Google DeepMind said that AI agents, guided by human cryptanalysts, uncovered two weaknesses in legacy 1024-bit RSA. The work is described in two working papers written with cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria): Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation and Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS. Both papers carry the same boxed warning: the results do not threaten deployed cryptosystems based on 2048-bit and larger RSA. This page is the long-form briefing behind the BSH Technologies Instagram carousel.

Weakness 1: RSA signature padding stops helping past half a block

The first paper studies an attacker who temporarily gets a signing interface (an oracle) that applies a fixed format to caller-supplied data, then must forge new signatures after access is withdrawn. For the PKCS#1 v1.5 format used by the PKCS#11 mechanism CKM_RSA_PKCS, the authors prove that once the caller controls more than about half of the signed block, or a 64-byte digest at 1024 bits, the format adds no difficulty compared with an unrestricted oracle. With a shorter 32-byte digest the problem stays harder, but the paper lowers its asymptotic cost exponent from 1.8171 to 1.5803, which DeepMind summarises as roughly 1,600x at 1024 bits. That figure is a theoretical estimate; the improved algorithm has not been run at cryptographic size. Signers that hash inside the device sit outside both oracle models.

Measured: the same 1024-bit computation with 3.5x less CPU

The agents re-ran the 1024-bit computation published by Shea, Haller, Suhl, Heninger and Thomé on the same modulus, polynomials and factor-base bounds. The first root took 391 CPU core-years (318 offline + 73 online) against 1,380 before, about 3.5x less. The paper is explicit that this is implementation and execution efficiency, not a new algorithm: an optimised fork of the CADO-NFS siever accounts for much of it. Calendar time was 3.2 days on up to about 300,000 CPU cores and 16 GPUs, against about five months for the earlier run, a gap the authors attribute mainly to parallelism. Factoring the same modulus outright is estimated at 500,000 to 1,000,000 core-years.

How the AI agents worked: supervisor, executor, human gate

Section 6 of the first paper is the part most likely to matter beyond RSA. A supervisor model wrote the design, set the budget and checks for every stage, and audited results. An executor model wrote and tested the code, launched and monitored jobs, and diagnosed faults, including a 32-bit index overflow that only appeared at full scale. The agents wrote about 33,500 lines of code in 19 changes and ran 336 distributed experiments. The human researcher chose the problem, approved irreversible steps and sent about 20 short messages, mostly approvals; the paper says the researcher wrote no code, launched no job and diagnosed no fault. We covered a similar supervisor/worker split in DeepSeek's super-agent harness, and AI-produced mathematics at scale in OpenAI's 722 AI-written math manuscripts.

Weakness 2: fan factories make batch factoring cheaper

The second paper is about economics when many keys of the same size must be broken. Coppersmith's multiple number field sieve (MNFS) has set the best per-key cost for a modest shared budget since 1993. The new fan factory gives each target its own family of number fields fed by shared precomputation. With a precomputation costing about one ordinary factorisation, each further 1024-bit integer costs about 1/58 of a standard number field sieve run, roughly 30x less than MNFS, at leading order. The authors stress these are theoretical estimates with o(1) terms set to zero: no fan factory has been built and no keys were factored. The algebraic identities are machine-checked in Lean 4, produced by a two-agent harness where one model wrote proofs and another verified them.

Is 2048-bit RSA safe? What to do now

Yes, for these results. Both papers state that deployed RSA of 2048 bits or more is not threatened, and NIST SP 800-131A has long disallowed 1024-bit RSA for generating new signatures. The practical to-do list is short: inventory any leftover 1024-bit keys, especially in hardware signers or legacy PKCS#11 interfaces that sign caller-controlled data, and migrate them. The bigger signal is tempo. As DeepMind put it, historical hardness assumptions need continuous stress-testing in an era of AI-assisted mathematics. This echoes our coverage of Claude and the NIST elliptic-curve seeds and the defender-first access model behind OpenAI GPT-6 Cyber and Daybreak Red. Press coverage such as Interesting Engineering led with the 1,600x figure; the papers themselves separate the measured 3.5x from the theoretical estimates.

Sources

• Google DeepMind: Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation (working paper, PDF)
• Google DeepMind: Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS (working paper, Nov 5, 2026, PDF)
• Google DeepMind: Advancing the frontier of cryptanalysis (announcement post, Nov 6, 2026)
• Shea, Haller, Suhl, Heninger and Thomé: Forging 1024-bit RSA signatures in nearly SNFS time (IACR ePrint 2026/2131)
• NIST SP 800-131A Rev. 2: Transitioning the Use of Cryptographic Algorithms and Key Lengths
• Interesting Engineering: Google DeepMind finds 1,600x faster way to expose encryption flaws