Several outlets report that Google DeepMind used AI models, working under human direction, to find two weaknesses in legacy 1024-bit RSA encryption. The reports say 2048-bit RSA is not affected. We searched for DeepMind's own publication and could not find it, so this post separates what is claimed from what the public record confirms. One related paper is verifiable: a September 2026 UC San Diego and INRIA preprint on forging 1024-bit RSA signatures.
TL;DR: claimed vs. verified
| Item | Claimed by | Verified? |
|---|---|---|
| DeepMind AI agents found two weaknesses in 1024-bit RSA | Crypto Briefing, other secondary outlets | Not by us. No DeepMind primary text found |
| One weakness enables signature forgery | Same reports | Unconfirmed for DeepMind. A separate public paper shows 1024-bit forgery |
| Specific speedup multipliers | Not given in the Crypto Briefing report | No figures to verify |
| 2048-bit keys unaffected | Reports quoting DeepMind | Plausible; no primary text |
| Work led by Dj Dvijotham and Abhradeep Thakurta with Nadia Heninger and Emmanuel Thomé | Crypto Briefing | Not confirmed. Heninger and Thomé are authors of the separate ePrint paper |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
What was reported
According to Crypto Briefing, published November 6, 2026, DeepMind says its AI models found two weaknesses in 1024-bit RSA. The first enables forgery of digital signatures. The second is a new algorithm that lowers the cost of batch factoring for related moduli, meaning an attack on many moduli at once when they are related in certain ways.
The article says humans still direct the work while the models do much of the exploratory work, and it says the findings suggest attacks may need far less computing effort than cryptographers assumed. It does not link to a DeepMind blog post or X post. It gives no speedup figures, so any multiplier quoted elsewhere is unverified.
What we checked and could not find
We searched for a DeepMind blog post, paper, or official account post and found none. That does not mean it does not exist. It means we cannot read the methods, the exact claims, or the baselines. Until it is public, treat every number as the reporting outlet's, not DeepMind's.
The related paper you can verify
A different result is public. The IACR ePrint paper Forging 1024-bit RSA signatures in nearly SNFS time was posted on September 20, 2026 by Laura Shea, Miro Haller, Adam Suhl and Nadia Heninger of UC San Diego, and Emmanuel Thomé of INRIA Nancy. Its abstract says:
- It implements a 2007 algorithm of Joux, Naccache and Thomé that forges RSA signatures after temporary access to a raw signing or decryption oracle, in time close to the special number field sieve, without factoring the key.
- The attack took 1,380 CPU core-years over five calendar months and made 2^32 oracle queries. After precomputation, forging any signature takes 180 core-years offline.
- The authors used a hardware security module as the signing oracle, impersonating it through black-box API interactions without exfiltrating the key.
- Extrapolating, they conclude RSA with a signing oracle has 15 to 30 bits less security than factoring-based estimates for 1024- to 4096-bit keys, and that even 4096-bit RSA does not appear to meet a 128-bit level in that attack model.
This paper involves no AI. Two of the names in the DeepMind coverage, Heninger and Thomé, appear on it, which may explain some blending of the two stories in the press. We could not confirm whether the DeepMind work builds on it.
The two terms in plain language
RSA signature forgery. RSA signs a message by applying the private key to it. A forger wants a valid signature on a message the key owner never signed. In the UCSD setup, the attacker can ask a device, such as an HSM, to sign chosen inputs for a while. The attacker then uses that access to build signatures offline later, without ever learning the private key. The risk is greatest where a system exposes raw signing or decryption without padding checks, or where blind signature schemes give an attacker a signing oracle by design.
Batch factoring. Normally you attack one RSA modulus at a time. If many moduli share structure, for example they were generated with weak randomness or share prime factors, an attacker can work on all of them together and spread the cost. Reports say the DeepMind algorithm lowers the cost of this group attack when the moduli are related in certain ways. That would matter most for large collections of old keys, such as device fleets that generated keys at first boot.
Neither idea breaks a properly generated 2048-bit key used with standard padding. Both are reminders that "the cost of factoring" is not the only number that decides real-world security.
How AI claims in cryptography should be read
Cryptanalysis has a strict culture. A claim counts when the method is written down, the numbers can be reproduced, and other cryptographers can attack the claim. Press coverage of a lab announcement is a pointer, not evidence. Three questions help:
- Is there a paper or preprint? On ePrint or arXiv, with named authors and methods.
- What is the baseline? A big multiplier over a weak baseline can still be a small absolute gain.
- What did the AI actually do? Generate conjectures, search parameter spaces, write and test code, or find the key idea? "Under human direction" covers a wide range.
The UCSD paper is a good model of the standard: it states exact core-years, query counts and the hardware used. When the DeepMind text appears, hold it to the same bar.
Timeline: how we got here
- 2007: Joux, Naccache and Thomé describe an algorithm for forging RSA signatures near special number field sieve time, per the UCSD abstract.
- 2013: NIST disallows 1024-bit RSA for generating new signatures, in SP 800-131A.
- September 20, 2026: UCSD and INRIA post their 1024-bit forgery implementation to ePrint.
- November 6, 2026: Outlets report the DeepMind announcement. We could not find the primary text.
Why 1024-bit RSA was already weak
NIST has disallowed 1024-bit RSA for generating new signatures since 2013 under SP 800-131A. A 1024-bit key offers roughly 80 bits of security by common estimates. Real systems should be on 2048-bit or larger keys, or on elliptic curves. So even if the reports are exact, the practical exposure is legacy hardware, old certificates and embedded devices, not mainstream web traffic.
Why it still matters for AI readers
The interesting claim is not the key size. It is that AI agents were used as exploratory research assistants in cryptanalysis. We have seen similar claims in other fields on explainx.ai: Anthropic research on quantum circuits, Google Research agents running an autonomous wet lab, and DeepMind's compute credits for European researchers. In each case, the lasting value depends on whether the results are published and independently checked.
It also connects to defense. The same week, prosecutors charged three men over an AI impersonation fraud worth $129 million. Attackers using AI is one risk; defenders using AI to stress-test standards, as DeepMind frames this work, is the other.
What would change our view
Three things would move this from claimed to verified. First, a DeepMind paper or blog post with the method and measured costs. Second, independent confirmation from the named cryptographers about their role. Third, a reproduction or a critique from researchers who did not take part. If the paper shows the gains apply only to special related moduli, as the reports hint, the real-world impact will stay narrow even though the research method, AI agents exploring mathematical structure, could still be notable. If the paper shows a general speedup against deployed parameters, the story becomes far bigger, and the post-quantum migration timeline would deserve a fresh look.
How to check the claim yourself
- Look for the DeepMind paper or blog post and read the abstract and numbers directly.
- Compare the claimed speedups against the baseline the authors use. A claimed gain of any size needs a stated baseline and a stated measure.
- Check the IACR ePrint archive and cryptography mailing lists for expert commentary.
- See whether named collaborators confirm their involvement.
- Separate "weakness found" from "practical attack demonstrated." Only the second one threatens deployed systems.
For AI-agent risks in your own stack, AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions.
What to do now
If you run only 2048-bit or larger RSA, or elliptic curves, nothing in these reports requires emergency action. Inventory any 1024-bit keys, especially in old HSMs, firmware signing and legacy certificates, and retire them. If your systems expose a raw signing oracle, the UCSD paper is worth reading. And if you are planning a post-quantum migration, this is more evidence to start. Our guide to Google's public SynthID verification site and the DeepMind DetectorScope work show how the lab approaches verifiable claims in other areas.
We will update this post when DeepMind's own text appears.
Related reading
- Anthropic research on fewer-qubit quantum circuits
- Google Research agents and the autonomous wet lab
- DeepMind compute credits for European researchers
- DeepMind DetectorScope AI text detector
- Google SynthID verification site guide
- DOJ charges three over $129M AI impersonation fraud
- NIST SP 800-131A
Details are accurate as of November 6, 2026. The DeepMind claims come from secondary reports and may change when primary text is published.