DeepMind agents find two new weaknesses in RSA-1024

What DeepMind announced

Pushmeet Kohli, VP of science at Google DeepMind, announced two cryptanalysis working papers on November 6, 2026. The authors include Nadia Heninger (UC San Diego, Inria) and Emmanuel Thomé (Inria, a lead developer of CADO-NFS). DeepMind says AI agents working under human supervision reached two new results in weeks.

Both papers open with the same warning: the results do not threaten deployed systems based on 2048-bit or larger RSA. The target is legacy 1024-bit RSA.

Paper one: forging signatures with a signing oracle

The scenario comes from a 2007 paper by Joux, Naccache and Thomé. An attacker gets temporary access to a signing device such as an HSM that signs data the attacker submits. Later the device is gone, and the attacker must produce new signatures. The private key is never recovered.

The first result concerns PKCS#1 v1.5. Once the caller controls roughly half of the signed block or more, the padding adds no difficulty compared with raw RSA. At 1024 bits that threshold sits around a 64-byte digest. A 32-byte digest such as SHA-256 stays below it. Devices that hash the message internally fall outside both models.

The second result is a new algorithm for the harder case, where the attacker controls only a short input. DeepMind's theoretical estimate puts it at roughly 1,600x faster than the best previous method at 1024 bits. It has not been run at any cryptographic size, so that figure is a projection.

What actually ran: 391 core-years instead of 1,380

The measured part is a reproduction. In 2026, Shea, Haller, Suhl, Heninger and Thomé used the same method against an HSM at 1024 bits: 1,380 CPU core-years, five months and 2^32 queries. With the same algorithm, polynomials and bounds, the agents reached the first forged root in 391 core-years, about 3.5x less.

The authors credit implementation and execution, not a new algorithm. Their optimized siever is 1.8 to 4.4x faster than stock CADO-NFS on the same machine. For comparison, factoring the same modulus outright is estimated at 500,000 to 1,000,000 core-years.

How the agents worked

Two models did the work, named only Model A and Model B in the paper. The supervisor wrote the design document, set per-stage CPU and memory budgets, defined checks and audited results. The executor wrote and tested code, launched distributed jobs and fixed failures.

The human researcher set the goal and approved irreversible steps in about 20 short messages. The agents wrote about 33,500 lines of new code and ran 336 distributed experiments, peaking at about 300,000 CPU cores and 16 GPUs. Every stage ran first on a probe or a 1% canary slice. That is how they caught a 32-bit index overflow that made the first computed root wrong.

Paper two: cheaper batch factoring

The November 5 Fan Factories paper asks what happens when someone wants to factor many RSA keys of the same size. After a precomputation of about one factorization, each extra 1024-bit key would cost about 1/58 of a normal number field sieve. The authors say that is 30x cheaper than Coppersmith's 1993 MNFS.

This is an asymptotic estimate: no fan factory has been implemented. The algebraic identities were checked in Lean 4, with one model generating proofs and another verifying them.

Why it matters

This does not break RSA-2048. But 1024-bit keys still show up in old DKIM records, HSM configurations, firmware signing and legacy PKI. An HSM that exposes raw RSA or PKCS#1 v1.5 signing over caller-supplied data with a 1024-bit key fits this model. The attack needs billions of queries, which rate limits and logging should catch.

The bigger story is on the AI side: agents delivered both engineering and proof drafts under expert supervision. OpenAI pointed the same way this week with GPT-6 Cyber: GPT-6 Cyber: OpenAI's new cybersecurity model. The papers are not peer reviewed yet, and the models are not named.

Key takeaways

• RSA-2048 and larger are unaffected; legacy 1024-bit RSA is the target.
• The measured result is 391 core-years versus 1,380, from better implementation, not new math.
• The 1,600x and 30x figures are theoretical estimates that have not been run.
• If you still have 1024-bit keys in an HSM or DKIM, now is a good time to replace them.