DeepMind's AI agents found two cracks in legacy 1024-bit RSA — and modern keys are untouched

Google DeepMind turned its AI agents loose on one of the oldest locks in internet security — and the agents came back with two new ways to pick it. The lock is 1024-bit RSA, an encryption standard the industry retired years ago. Your bank account is not in danger. But the speed is the story: work that would have taken human cryptographers far longer was finished in weeks, by agents working under human supervision.

The findings were announced on November 6 by Pushmeet Kohli, DeepMind's vice president of science, in a post on X, and written up in two technical papers. The research was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta, working with outside cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. Everything ran in a sandbox, against a retired standard chosen precisely because attacking it harms nobody.

The first crack: a signature you can fake#

Digital signatures are the wax seal of the internet: they let a computer verify that a software update, a document or a message genuinely comes from its claimed source. Before signing, most schemes add padding — extra preset data that rounds the message out to a fixed-size block. Padding has long been assumed to make forgery harder. DeepMind's agents found a sharper answer: it depends on how much of the signed block the attacker controls.

Once an attacker controls roughly half the signed block or more, the agents found, padding stops adding meaningful protection — forging a signature becomes nearly as easy as if there were no padding at all. To check the finding, the team ran it in a sandbox against an already-solved 1024-bit benchmark key from earlier academic work. The agents' implementation reproduced the forgery using 3.5 times less CPU time than the previous approach, and at under a thousandth of the computing power it would take to factor the underlying key itself.

And for the harder cases — where the attacker controls only a small slice of the block, such as a 32-byte digital fingerprint — the agents produced a new algorithm that, on DeepMind's theoretical estimates, improves on the best previously known method by roughly 1,600 times for 1024-bit keys. That 1,600x figure is a theoretical estimate, not a measured result, and it is worth keeping the distinction in mind: the measured number is the 3.5x CPU saving. Either way, the direction is the same — the old lock is weaker than the textbooks assumed.

The second crack: factoring in bulk#

The second result attacks a different angle: factoring many RSA keys at once. RSA's security rests on a simple asymmetry — multiplying two large primes is easy, splitting the product back into those primes is hard. But RSA keys almost always come in standard sizes, 1024 or 2048 bits, so an attacker going after many keys of the same size can, in theory, spread one large upfront computation across all of them and lower the average cost per key.

DeepMind's agents found a new algorithm with better asymptotic complexity than any previously known batch method, cutting the average cost of factoring each additional 1024-bit key by about 30 times. The point is not that one key got cheaper to break — it is that the hundredth key got much cheaper than the first. For anyone holding a pile of legacy keys, the discount grows with the haul.

What it does not mean#

DeepMind is explicit about the limits, and they matter more than the headlines. These results apply only to obsolete 1024-bit RSA. Modern deployments almost universally use 2048-bit keys or larger, and those are unaffected by these specific findings. Online banking, messaging apps, software updates and digital currencies are not threatened, and no live keys were broken — the experiments ran in simulation, on a standard that the US standards body NIST stopped accepting for generating new signatures back in 2013.

That is also why the research was publishable at all: RSA-1024 is a safe proving ground, complex enough to be a meaningful test and retired enough that attacking it endangers nobody. The papers are public so the wider security community can check the work and build on it.

Why it still matters#

Three reasons to take the result seriously anyway. First, retired does not mean gone. Old devices, signed firmware and legacy certificate chains still carry 1024-bit keys, and every one of them just got measurably weaker. The practical takeaway is an audit: find any 1024-bit RSA still in use, especially in signatures, and plan the move to 2048-bit or larger — or to post-quantum schemes — now rather than later.

Second, this is a demonstration of AI as a research accelerator, not just a chatbot. The agents did not merely run known attacks faster; they helped develop, implement and debug new procedures, and arrived at results human cryptographers had not reached. The same machinery that stress-tests a retired cipher this year will be pointed at live ones next.

Third, the dual-use tension is real. Every technique that helps defenders audit old cryptography also lowers the bar for attackers, and DeepMind's open publication means the knowledge is now in the wild for both sides. That is the standard bargain of open security research, and it has usually favoured the defenders — but only when the defenders actually patch. The clock on that has just ticked a little faster.

What to watch: independent verification of the two papers; whether the techniques extend toward larger keys, which DeepMind says these findings do not threaten; and how quickly organisations holding legacy keys act on the audit message. The encryption protecting your everyday life is fine. The encryption protecting its forgotten corners is not — and AI just made those corners easier to find.

Sources: Let's Data Science; Crypto Briefing; OfficeChai; and AI News Today. Images are AI-generated editorial illustrations.