On 6 November 2026, Google DeepMind announced that its AI agents — working under the direction of human cryptographers — had found two new weaknesses in legacy 1024-bit RSA, one of the oldest encryption standards still in use. The headline numbers are striking: a signature-forgery method the team estimates is about 1,600 times more efficient for short fingerprints, and a batch-factoring method that cuts the cost of each extra key by about 30 times. The equally important headline is the one DeepMind printed in bold in both of its papers: modern 2048-bit RSA is not affected.
What did DeepMind’s AI agents actually find?
Two results, and they are different kinds of finding. The first makes it cheaper to forge digital signatures on 1024-bit RSA keys. The second makes it cheaper to factor many 1024-bit keys at once, after one large shared computation. Neither breaks a single 1024-bit key faster than the general number field sieve — the method that remains the yardstick for RSA strength — and neither touches 2048-bit keys at all.
The announcement came as an essay, not a product launch. DeepMind’s vice president of science, Pushmeet Kohli, set out the findings on 6 November 2026 in a post on X titled “Advancing the frontier of cryptanalysis”, alongside posts from Google DeepMind’s own account. The work was led at DeepMind by Dj Dvijotham and Abhradeep Thakurta, working with two of the best-known names in practical cryptanalysis: Nadia Heninger of UC San Diego and Inria, and Emmanuel Thomé of Inria. It is written up in two working papers dated 5 and 6 November 2026: “Modular Roots from a Restricted Oracle”, on the signature forgery, and “Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS”, on batch factoring.
The agents were guided, not autonomous — and that distinction matters. DeepMind describes the project as AI-assisted research: human cryptographers steered the work, and the models did the heavy exploratory lifting, testing ideas faster than a team of mathematicians could on their own. The results arrived in a matter of weeks, where uncovering vulnerabilities of this kind historically took years. As Kohli put it: “We cannot treat cryptographic hardness as a fixed assumption.” The same human-guided agent pattern is spreading across the industry — our Anthropic Agent Skills explainer covers how agent capabilities are now being standardised.
How does the signature forgery work — and what does 1,600x really mean?
A digital signature works like a wax seal on a letter. It proves who sent a message and that nobody tampered with it on the way. RSA signatures rely on padding — extra structured data mixed into the signed block — to stop an attacker from turning one valid signature into a forged one. DeepMind’s agents found that the padding gives far less protection than assumed: once an attacker controls about half of the signed block, padding adds little protection at all.
The measured result is a 3.5x saving, not a 1,600x one. The agents reproduced a forgery from a September 2026 academic preprint — “Forging 1024-bit RSA signatures in nearly SNFS time” by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé (IACR ePrint 2026/2131, 20 September 2026) — using 3.5 times less CPU time than the original team: 391 CPU core-years against 1,380, a computation that took the original team five calendar months, debugged by the agents in under four days. The forgery ran at under a thousandth of the computing power it would take to factor the underlying key itself. Everything ran in a sandbox, against an already-solved benchmark key, and DeepMind says no live systems were touched.
The 1,600x figure is a theoretical estimate for the harder case. Where the attacker controls only a small slice of the block — a 32-byte digital fingerprint, for example — the agents produced a new algorithm that DeepMind estimates improves on the best previously known method by roughly 1,600 times for 1024-bit keys. That number comes from the mathematics, not from a timed attack, and it has not been independently replicated. Keep the two numbers apart: 3.5x is what was measured; 1,600x is what DeepMind calculates.
| Figure | What it is | Measured or estimated? |
|---|---|---|
| 3.5x less CPU time (391 vs 1,380 CPU core-years) | Sandbox reproduction of a solved 1024-bit signature forgery | Measured, per DeepMind |
| ~1,600x better for a 32-byte fingerprint | New forgery algorithm vs the previous best method | Theoretical estimate, per DeepMind |
| ~30x lower cost per extra key (about 1/58 of a GNFS run) | Batch factoring of many 1024-bit keys after a shared precomputation | Leading-order theoretical estimate, per the paper |
| 2048-bit and larger RSA | Modern key sizes | Not affected, per DeepMind and both papers |
What are “fan factories” — and why does batch factoring matter?
RSA’s security rests on one bet: factoring is brutally hard. Multiplying two huge prime numbers is easy; working backwards from the product to find those primes is not. The product is called the modulus, and factoring it is the key to breaking the lock. Batch factoring means attacking many moduli at once instead of one at a time — and when the moduli are related in certain ways, the group attack can be cheaper than attacking each key alone.
A “fan factory” is DeepMind’s name for the new batch method. Pay one large setup cost once — roughly equal to the cost of factoring a single 1024-bit number — and then factor each further 1024-bit key of the same size for about 1/58 of the cost of a full general number field sieve run. The authors describe that as roughly 30 times less than the best previous batch method. The paper is explicit about its limits: the figure is a leading-order theoretical estimate, and no fan factory has actually been implemented. The algebraic identities behind it are reported as machine-checked in Lean 4, a formal proof system — a check on the maths, not a working attack.
The threat is economic, not immediate. If the estimate holds up, an attacker who wants to break a large fleet of old keys — say, every 1024-bit certificate in a legacy system — would pay far less per key after the first one. That is the scenario that makes security teams take notice, even while the method remains theoretical.
Are my passwords, bank account and messages at risk?
No — and that is the part of the story that deserves equal weight. DeepMind says the results only affect obsolete 1024-bit RSA systems, and both papers carry the same caveat in bold: the findings do not threaten deployed cryptosystems based on 2048-bit and larger RSA. Modern systems almost universally use 2048-bit keys or larger, and reporting of the announcement confirms there is no threat to online banking, messaging apps, software updates or digital currencies from these specific findings.
1024-bit RSA was already retired before this research existed. US federal guidance disallowed 1024-bit RSA for generating new signatures in 2013, more than a decade ago. What survives today is the long tail: old devices, embedded systems, signed firmware and long-lived certificates that were issued when 1024-bit keys were still normal and have never been replaced. That long tail is the real audience for this research — not you, and not your bank.
Who still uses 1024-bit RSA — and what should they do?
The check is an inventory, not a panic. If you manage systems, three questions settle whether anything in your stack still relies on 1024-bit keys. First: is anything in your stack older than 2013, or built to a 1024-bit specification? Old hardware, embedded devices and legacy appliances are the usual suspects. Second: can you list every certificate and firmware signature in your systems? Long-lived certificates and signed firmware are where 1024-bit keys hide, because they are issued once and forgotten. Third: is any internet-facing system still accepting 1024-bit signatures? That is the priority order — internet-facing first, then internal systems, then offline devices. Replace 1024-bit certificates, re-sign firmware with modern keys, and retire anything that cannot be upgraded. The discipline is the same as any other patch cycle, as our PHP2Shell patch guide shows for website owners: know what you run, check it against the current threat, and fix the oldest thing first.
For everyone else, the honest answer is: nothing. If your laptop, phone and accounts were set up in the last ten years, you are already on the safe side of this story. The people who need to act are the ones running the long tail — and the action is a scheduled migration, not an emergency.
Why this matters beyond RSA: AI is now stress-testing cryptography
The bigger story is tempo. Cryptanalysis — the discipline of stress-testing encryption to find its limits — used to move at the speed of human mathematicians working for years. DeepMind’s agents reached two publishable results in weeks. That compression is the real news: the same AI-assisted approach can now be pointed at any cryptographic standard, old or new, and the results will arrive faster than the industry’s usual review cycles. It is the same pattern we saw in our own benchmark coverage this week: AI systems are now being measured, and measuring each other, faster than the institutions around them can absorb the results. Our SemiAnalysis GDPx explainer showed the best AI scoring just 12% on real work — but cryptanalysis turns out to be one of the jobs where AI assistance is already producing results humans would take years to reach.
DeepMind is saying so directly. Its announcement post on LinkedIn puts it plainly: “As we enter a new era of AI-enabled math and computation, we can no longer rely on historical hardness assumptions and must continuously stress-test cryptographic standards.” The implication is that key sizes and algorithms judged safe by decade-old analysis need to be re-tested continuously — not once, and not only when someone finds a flaw. Crypto Briefing’s coverage notes the RSA research arrives alongside other 2026 findings involving attacks on post-quantum candidates such as HAWK — a reminder that the stress-testing is already spreading beyond retired standards.
What we still don’t know
Neither paper has been peer reviewed yet. Both are working papers, and no independent group has replicated the headline figures. The batch-factoring paper is dated 5 November 2026; at the time of the announcement, the full text of the signature paper had not yet been published in full, according to secondary reporting — so outside cryptographers could not yet double-check the 1,600x calculation themselves. That will change as the papers circulate, and the numbers may be revised.
The 30x figure is an estimate about a method nobody has built. “Fan factories” exist on paper, with machine-checked algebra behind them. Whether the theoretical saving survives contact with a real implementation — and what the constant factors look like in practice — is unknown until someone builds one. The sandbox is not the real world either: the forgery was reproduced on a solved benchmark key in isolation, and a real attack would face defences, monitoring and key-management practices a sandbox does not model. None of that makes the findings unimportant — it makes them a warning with a long fuse, not a fire alarm.
Our take: run a three-question crypto inventory
This is the part no announcement spells out, so here it is plainly. The RSA findings are not a consumer story — they are a maintenance story. The most useful thing any organisation can take from them is a 30-minute exercise, run once, that answers three questions: what in our stack still uses 1024-bit keys, where are the long-lived certificates and firmware signatures, and what is internet-facing. If the answer to all three is “nothing we can find”, you are done — and you have also just built the inventory you will need the next time an AI-assisted finding lands on a standard you actually use.
The second lesson is about planning horizons. If AI agents can compress years of cryptanalysis into weeks, then the timelines we use for migrating to new cryptography — including the long post-quantum migration already under way — should be planned with the same compression in mind. DeepMind chose a retired standard precisely because attacking it harms nobody; the next team to run this playbook may not choose so kindly. The right response is not fear, it is cadence: test continuously, migrate on schedule, and keep an inventory so the next announcement tells you in minutes whether it affects you.
Frequently Asked Questions
Does this mean RSA encryption is broken?
No. The findings affect only legacy 1024-bit RSA, a key size retired for new signatures in 2013. Modern 2048-bit and larger RSA keys are unaffected, according to DeepMind and both working papers.
Is my online banking or messaging at risk?
No. Banking, messaging apps, software updates and digital currencies use 2048-bit keys or larger, which these specific findings do not touch. Your passwords do not need changing because of this announcement.
What does “1,600 times faster” actually mean?
It is DeepMind’s theoretical estimate for forging signatures on short 32-byte fingerprints with 1024-bit keys — not a measured result. The measured result was a sandbox forgery reproduced with 3.5 times less CPU time (391 vs 1,380 CPU core-years) than the original academic team.
What is a “fan factory”?
It is DeepMind’s name for a new batch-factoring method: pay one large shared computation once, then factor each further 1024-bit key for about 1/58 of the cost of a full factoring run — roughly 30 times cheaper than the best previous batch method. It is a theoretical estimate; no fan factory has been implemented.
I manage old devices or certificates — what should I do first?
Run an inventory: list every certificate and firmware signature, find anything still using 1024-bit keys, and replace internet-facing ones first. Retire or re-sign anything that cannot be upgraded. For personal devices bought in the last decade, no action is needed.
Sources and methodology
Sources: Crypto Briefing — Google DeepMind’s AI agents expose two weaknesses in legacy 1024-bit RSA (6 November 2026); Data Studios — Google DeepMind AI agents find two weaknesses in legacy 1024-bit RSA (8 November 2026); AI Frontier Post — DeepMind’s AI agents found two cracks in legacy 1024-bit RSA (7 November 2026); Let’s Data Science — Google DeepMind AI agents find faster attacks on legacy RSA-1024; Interesting Engineering — Google DeepMind agents expose older encryption flaws (6 November 2026); Santage AI (6 November 2026); gurujicorp (7 November 2026); Google DeepMind LinkedIn announcement post (6 November 2026).
Methodology: All claims were verified on 8 November 2026 against multiple independent secondary reports of Google DeepMind’s 6 November 2026 announcement and the two working papers. Every figure is DeepMind’s own and is attributed to DeepMind; theoretical estimates are labelled as estimates and kept separate from measured results. The article was desk-researched and was not hands-on tested. No X post was embedded because no verified status URL for the announcement post was found.
Arva Rangwala covers AI news, AI tools, guides and prompts for OpenAIMaster — what is new, what is worth using, and how to put AI to work.
Related posts
OpenAI’s New Lab Test Says GPT-6 Astra Handles Messy Science 66.7% of the Time — Here’s What That Test Really Measures
BioBasicsBench scores AI on 100 wet-lab tasks. GPT-6 Astra earned 66.7% of rubric credit — best of seven, but OpenAI…
Read more
AI Is Now Improving Itself Twice as Fast — Inside the METR Report Anthropic Let Outsiders Read
METR spent 11 weeks inside Anthropic and found its models are improving about twice as fast, mostly thanks to AI…
Read more
Alibaba Previewed Qwen4: Four Models, One That Runs on Your PC
Alibaba has previewed Qwen4 in four tiers — Max, Plus, Flash and a 27B model built to run on a…
Read more