TL;DR
Did Google DeepMind's AI break RSA encryption?
No. Google DeepMind says AI agents, guided by researchers, found two weak spots in old 1024-bit RSA encryption. Banks, email and most websites use stronger 2048-bit keys, so nothing breaks today. Most people have nothing to do; if you run old gear that still uses 1024-bit keys, ask your vendor about an upgrade.
What did DeepMind find?
Google DeepMind shared two research papers on Friday, November 6, 2026, with a write-up on X by Pushmeet Kohli, its VP of Science. Both papers target RSA, a widely used kind of encryption that rests on how hard it is to split a huge number back into the two primes that made it. They focus on 1024-bit keys, an older and shorter key size that security standards have been retiring for years.
The work was led by Dj Dvijotham and Abhradeep Thakurta, with outside cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria) among the co-authors. Both papers are labeled working papers, so they haven't been through peer review yet.
Weakness 1: faking digital signatures
A digital signature is how a computer proves a file, update or website really came from who it says. Before signing, many systems add "padding," fixed filler that fills the message out to a set size and is meant to make forgery harder.
DeepMind's answer: padding stops helping once an attacker controls about half of the signed block or more. At that point, forging a signature gets as easy as if there were no padding at all. For the harder case, where the attacker controls only a short 32-byte chunk, Kohli says a new method improves on the previous best by roughly 1,600 times for 1024-bit keys. That figure is a theoretical estimate, and nobody ran it.
To show the easier case at full scale, two cooperating AI agents re-ran a known attack on a 1024-bit key that academics had already solved, in a sandboxed simulation that didn't touch any live system. Per the paper:
- 3.5 times less computing. The first result took 391 CPU core-years (one processor core running for a year, times 391), against 1,380 for the original team.
- Mostly done by the agents. A supervisor agent wrote the plan and checked results, and an executor agent wrote about 33,500 lines of code, ran the jobs and fixed failures. The human researcher sent about twenty short messages, most of them approvals.
- About three days of computing. Running on up to 300,000 CPU cores and 16 GPUs, the agents finished in 3.2 days from the first full-scale job. The earlier team took about five months, a gap the paper puts mostly down to running more machines at once.
Weakness 2: cracking many keys at once
The second paper, dated November 5, looks at batch factoring, which means breaking lots of same-size keys together by sharing one big up-front computation across all of them. The agents found a new method for this.
At leading order, after an up-front computation about the size of cracking one key, each extra 1024-bit key would cost about 1/58 of cracking it from scratch. That's about 30 times cheaper per extra key than the best earlier batch method. The paper calls the 30x figure a theoretical estimate, and nothing was built or run.
Does this affect my bank, email or website?
No. Both papers say plainly that they don't threaten deployed systems using 2048-bit or larger RSA keys, which is what banks, email providers and most websites use today. The 1024-bit size is already no longer approved for creating new signatures under NIST's rules, which the signature paper cites.
The forgery attack also needs a lot of access. An attacker has to send their own inputs straight to the signing device, and the test run needed about 4 billion of those calls. Devices that hash the message inside before signing fall outside both attack models.
Why AI speed matters here
Breakthroughs in this kind of math usually take years. Kohli's write-up says these results show AI can probe the "hardness" behind encryption much faster, so security teams can't treat a key size as safe forever.
For most people, that's a reason for steady upgrades, not alarm. Old hardware is where 1024-bit keys tend to linger, and that margin shrinks faster when AI does the heavy lifting.
For Google's newest AI model built for coding and cybersecurity, read our Gemini 4 Carbon story.
The jargon, in one line each
| Term | What it means |
|---|---|
| RSA | A common encryption method based on how hard it is to split a huge number into its two prime factors |
| 1024-bit key | An older, shorter RSA key size; modern systems use 2048 bits or more |
| Digital signature | Math that proves a file or message came from its claimed sender and wasn't changed |
| Padding | Fixed filler added to a message before signing, meant to block forgery |
| CPU core-year | One processor core running nonstop for a year, a unit for big computing jobs |
| Batch factoring | Breaking many same-size keys together by sharing one large up-front computation |
X reactions
Google DeepMind announced the papers on X a few minutes after Kohli posted his write-up.
We’re sharing new research demonstrating how AI agents can accelerate the science of stress-testing encryption.
— Google DeepMind (@GoogleDeepMind) November 6, 2026
Guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems.
Our VP Science @Pushmeet explains more ↓ https://t.co/SqNkBbkih2
Our take
The headline number to watch is the calendar, more than the 3.5x. Two AI agents did a job in about three days that took a team of experts months, with a human mostly clicking approve. Attackers will get the same kind of help, so the gap between "old but probably fine" and "broken" will close faster than security teams are used to.
We like that DeepMind ran this on a retired key size, published the limits up front and brought in respected outside cryptographers. That's the responsible way to share this kind of result. For everyone else, it's a fair nudge to clear out old gear that still runs outdated encryption.
— Artificially Nerdy
What to do now
- Most people: nothing. Your bank, email and the sites you use rely on 2048-bit or stronger keys.
- Small business owners with older gear (routers, VPN boxes, card terminals, in-house tools) can ask their IT person or vendor one question: does anything we run still use 1024-bit RSA keys?
- Replace or update anything that does. Security standards already stopped approving 1024-bit keys for new signatures.
- Developers and IT teams should check that signing devices hash messages inside the device, which keeps them outside both attack models in the papers.
- Keep firmware and software updates switched on, since vendors move to stronger keys through updates.
FAQ
Did anyone actually crack a 1024-bit key?
No. The signature test re-ran an attack on a key academics had already solved, inside a sandboxed simulation. The batch-factoring result is a cost estimate, and DeepMind didn't factor any key with it.
Are these papers peer reviewed?
Not yet. Both are labeled working papers, so other researchers still need to check them.
Why test old 1024-bit keys at all?
Kohli's write-up says retired systems like RSA-1024 make safe proving grounds. Researchers can measure how fast attacks are improving without putting live systems at risk.
Sources
- Google DeepMind: Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation (PDF, working paper) — authors and affiliations, 391 vs 1,380 CPU core-years (3.5x), two-agent setup, 33,500 lines of code, about twenty human messages, 300,000 CPU cores and 16 GPUs, 3.2 days vs about five months, about 4 billion calls, 1024-bit no longer approved for new signatures, no threat to 2048-bit and larger RSA.
- Google DeepMind: Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS (PDF, working paper) — dated November 5, 2026. Batch factoring at about 1/58 the cost per extra 1024-bit key, 30 times less than the earlier batch method, theoretical estimate.
- Pushmeet Kohli on X: "Advancing the frontier of cryptanalysis" — November 6, 2026, 12:07pm ET. Official write-up: leads, sandboxed simulation, roughly 1,600x theoretical estimate for the 32-byte case, about 30x per extra key, "safe proving grounds."
- Google DeepMind on X — November 6, 2026, 12:20pm ET.
