Google DeepMind Says AI Agents Found Two Weaknesses in Legacy 1024-Bit RSA

Google DeepMind announced on Friday that AI agents working under human supervision discovered two weaknesses in 1024-bit RSA, an encryption standard long considered obsolete. The findings were revealed in posts on X by Pushmeet Kohli, who leads DeepMind's science work, and by the DeepMind account itself. Kohli said the team made the two advances in weeks [1].

The research was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, collaborating with cryptographers Nadia Heninger of UC San Diego and Inria, and Emmanuel Thomé of Inria [1][2][3].

What the agents found

First weakness: signature forgery via padding collapse. RSA digital signatures add structured padding to a message before signing to block forgery. DeepMind says the agents found that once an attacker controls roughly half of the signed block or more, the padding stops adding meaningful protection — forging a signature becomes nearly as easy as if there were no padding at all [1].

To test this, the agents ran a sandboxed simulation against an RSA-1024 benchmark key that earlier academic work had already solved. Their implementation reproduced the known forgery using 3.5 times less CPU time, and with less than one-thousandth of the computing power needed to factor the key itself [1].

For the harder case — where an attacker controls only a small part of the signed data, such as a 32-byte digital fingerprint — the agents produced a new algorithm that, by DeepMind's theoretical estimate, improves on the best previously known method by about 1,600 times for 1024-bit keys. DeepMind characterizes this figure as a theoretical estimate, not a measured attack [1][2].

Second weakness: cheaper batch factoring. The agents also found a method for batch factoring — attacking many RSA keys of the same size at once — with better asymptotic complexity than earlier batch techniques. DeepMind says this cuts the average cost of factoring each additional 1024-bit key by about 30 times [1][2].

Scope and limitations

Both findings are limited to 1024-bit RSA. DeepMind says modern deployments, which almost all use keys of 2048 bits or larger, are not affected [1][2][3]. That covers the encryption behind online banking, messaging, software updates and digital currencies.

1024-bit RSA has been deprecated for years. Old keys persist in firmware signing, legacy VPNs, embedded devices and internal certificate chains that have not been rotated [2].

The AI claim: speed, not autonomy

DeepMind frames the results as a demonstration of how AI agents can accelerate the science of stress-testing encryption. Kohli said the work reinforces the need to keep reassessing cryptographic assumptions rather than treating the hardness of a scheme as fixed [1].

The agents did not operate autonomously. They were guided by human cryptanalysts throughout. The weeks timeline likely reflects the overall project duration, given the heavy human involvement.

What is not yet public

• No paper. As of the announcements, DeepMind had not published a preprint or paper with full technical details. The 1,600x and 30x figures are the company's own estimates.
• No model names. The announcements did not identify which AI models powered the agents.
• Benchmark choice. The sandbox test reused an already-solved RSA-1024 key. Reproducing a known result faster is a valid engineering signal, but it is not a new break.
• Theoretical vs. measured. The 1,600x improvement for the low-control forgery case is a theoretical estimate. The 30x batch-factoring gain is described as an asymptotic complexity improvement; concrete runtime on real key sets has not been shown.

Why it matters

The practical impact is narrow but real for anyone still running 1024-bit RSA. The batch-factoring result is the more consequential: if factoring each additional key becomes roughly 30 times cheaper, an attacker with a large collection of old public keys gets a volume discount [2].

The broader signal is tempo. Cryptographic strength used to erode on a timeline measured in years. Agents that compress months of expert cryptanalysis into weeks — even with heavy human steering — change the planning horizon for migrations [2]. DeepMind's own framing is that this gives defenders better tools to measure how strong their cryptography really is [1].

For now, the evidence consists of a research announcement, a sandbox reproduction of a known result, and two theoretical estimates. The cryptanalysis community will need the full paper to evaluate the claims.