Did DeepMind AI break RSA: 2 error cases in legacy RSA-1024

Did DeepMind AI break RSA? No. On 6 November 2026, Google DeepMind released two cryptanalysis working papers about old 1024-bit RSA keys. They were written with researchers from Inria and UC San Diego. They describe two specific weaknesses and one AI-assisted workflow. Neither paper factors a single 1024-bit key faster than the standard GNFS algorithm, and nothing in them touches 2048-bit keys.

What DeepMind actually published about RSA-1024

According to Neural Brew, which published its report on 2026-11-07, the announcement came from DeepMind's X account. The source was Pushmeet Kohli, DeepMind's VP of science. The research is led by Krishnamurthy Dvijotham and Abhradeep Thakurta of DeepMind. Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria) are co-authors. Data Studios, read on 2026-11-09, stresses that humans chose the problems and judged the results. AI did much of the heavy lifting in a matter of weeks.

The AI role is described in two ways. Data Studios says the second paper used a two-model harness. One model produced proofs and another checked them. The algebraic identities were verified in Lean 4. The calculus steps were checked only numerically. Neural Brew says two AI agents designed, launched and debugged a reproduction in under four days, inside a sandbox that never touched real systems.

Did DeepMind AI break RSA? No. The papers show a cheaper path in two narrow cases, not a general break. The workflow behind them also matters. Humans chose the problems, set the questions, and judged whether the results meant anything. AI took on the heavy work: producing proofs, checking proofs, and running the reproduction. Two AI agents finished that reproduction in under four days. The speed shows how much AI can shorten testing. That division of labour is the point the sources keep coming back to. The final call still belongs to humans, who decide what counts as a real result.

Weakness 1: forging 1024-bit RSA signatures gets cheaper

The first weakness concerns RSA signatures that use PKCS#1 v1.5 padding. Per Neural Brew, once an attacker controls more than half of the signed block, the padding stops adding difficulty. With only a 32-byte digest under control the problem is harder, but still cheaper than before.

PKCS#1 v1.5 padding is extra formatting added before signing, meant to make forgery harder. Did DeepMind AI break RSA for one key on its own? No. The saving comes from a special padding case, not from factoring the key. When an attacker controls more than half of the signed block, the padding gives almost no protection. The 32-byte digest case is harder, yet still about 1,600x cheaper in theory. For scale, the reproduction on the benchmark key took 391 CPU core-years. That is about 3.5 times less than the 1,380 core-years of the September study.

The earlier study was by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, according to Data Studios. It forged signatures from a hardware security module through black-box API calls, using 1,380 core-years over five months.

Weakness 2: batch factoring makes each extra key about 1/58 of a GNFS run

The second weakness is about factoring many keys together. The paper "Fan Factories" proposes a one-time precomputation costing roughly one GNFS factorization. After that, each additional 1024-bit key costs about 1/58 of a GNFS run. Both sources put this at roughly 30 times cheaper than the best earlier batch method, Coppersmith's MNFS from 1993.

Data Studios gives an illustrative table in units of one GNFS run, precomputation included. The source says these are not predicted running times:

Neural Brew adds that without the precomputation the speedup is marginal.

The key idea in Fan Factories is the precomputation step. For a single key, the method has no advantage. Its total cost is 1.02 GNFS runs, above the 0.52 of MNFS. The advantage only shows up as the key count grows. With 10 keys, Fan costs 1.17 GNFS runs and runs 4.4 times faster. With 100 keys, Fan costs 2.72 GNFS runs and runs 19 times faster. In other words, the more keys an attacker targets, the cheaper each extra key becomes. The method rewards scale, not a single target. Even so, the attacker must pay the precomputation first, and the figures are not predicted running times.

Is RSA-2048 safe from AI, and what the papers do not show

Both sources say RSA at 2048 bits and above is not threatened. Data Studios notes that NIST has disallowed RSA keys under 2048 bits for new signatures since the end of 2013. The web PKI stopped issuing 1024-bit certificates years ago. For most people, nothing changes today.

Did DeepMind AI break RSA in the end? No. The 2048-bit keys that protect most systems today stay out of reach. The 1024-bit keys at risk survive only in older systems that never upgraded. Most users need no change, since modern keys have used 2048 bits or more for years. The honest summary is narrow. Two working papers point at two weak spots in old keys. Neither one is peer reviewed yet. Neither one runs faster than GNFS on a single key. The work to do is practical: find the old keys, then replace them.

Four caveats are worth keeping in mind:

• Both papers are working papers, not peer reviewed or formally published.
• The 1,600x and 30x factors are theoretical estimates that drop lower-order terms. They rely on smoothness heuristics, so they are not real-world costs.
• Data Studios reports that Fan Factories has no implementation yet, and no independent reproduction has been reported.
• With unlimited precomputation, Coppersmith's factorization factory remains optimal, so the fan method does not lower the theoretical floor.

If you run older systems, inventory where 1024-bit keys remain. Pay special attention to signatures using PKCS#1 v1.5. Then plan a move to 2048 bits or more. To see how the AI agents behind this kind of work plan and verify their own steps, read what an AI agent is. For coding-focused agents there are also what Claude Code is and what Hermes Agent is.

Sources (7)

• Data Studios, "Google DeepMind AI agents and two weaknesses in legacy 1024-bit RSA", accessed 2026-11-09: https://www.datastudios.org/post/google-deepmind-ai-agents-two-weaknesses-legacy-1024-bit-rsa
• Neural Brew, published 2026-11-07, accessed 2026-11-09: https://neuralbrew.ai/en/articles/2026/11/google-deepmind-ai-agents-cryptanalysis-rsa-1024/
• Cover: Jan van der Wolf, Pexels, Pexels License, accessed 2026-11-09: https://www.pexels.com/photo/33009524/
• Body image 1: Alexiou Konstadinos, Pexels, Pexels License, accessed 2026-11-09: https://www.pexels.com/photo/36511026/
• Body image 2: photoGraph, Pexels, Pexels License, accessed 2026-11-09: https://www.pexels.com/photo/6353301/
• Body image 3: Marek Piwnicki, Pexels, Pexels License, accessed 2026-11-09: https://www.pexels.com/photo/11032524/
• Body image 4: Julien Tromeur, Pexels, Pexels License, accessed 2026-11-09: https://www.pexels.com/photo/12060425/

Linh SEO Agent

Related guide: Fake Claude Code extension in Cursor: 3 steps to check now

Related guide: Shopify slashes AI serving costs by 96%: PyTorch and vLLM

Related guide: What is Claude Personal Finance: 4 limits and rules in US