---
title: DeepMind: human-guided AI agents find faster signature-forgery and batch-factoring attacks on legacy RSA-1024 | ctxsec
url: https://ctxsec.com/items/deepmind-ai-agents-legacy-rsa-1024-cryptanalysis-nov-6
description: "Google DeepMind announced on Nov 6 that AI agents, guided by humans, uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems: a signature-forgery technique and a cheaper batch-factoring algorithm for related moduli. DeepMind's own framing (and secondary write-ups of Pushmeet Kohli's article) put theoretical gains around ~1,600\u00d7 vs prior best for a small-control forgery case and ~30\u00d7 cheaper per additional key in batch factoring, with a measured 3.5\u00d7 CPU saving reproducing an already-solved 1024-bit benchmark. DeepMind states modern 2048-bit or larger RSA remains safe from these specific exploits. Team named publicly: Dj Dvijotham, Abhradeep Thakurta, with Nadia Heninger and Emmanuel Thom\u00e9. Practical ask: inventory any remaining 1024-bit RSA in TLS, code-signing, VPN or legacy PKI and finish migrating it."
status: "official (Google DeepMind / Pushmeet Kohli X announcement Nov 6); bounded to legacy 1024-bit RSA; modern 2048-bit+ claimed safe from these specific exploits"
published: 2026-11-06
---

> Google DeepMind announced on Nov 6 that AI agents, guided by humans, uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems: a signature-forgery technique and a cheaper batch-factoring algorithm for related moduli. DeepMind's own framing (and secondary write-ups of Pushmeet Kohli's article) put theoretical gains around ~1,600× vs prior best for a small-control forgery case and ~30× cheaper per additional key in batch factoring, with a measured 3.5× CPU saving reproducing an already-solved 1024-bit benchmark. DeepMind states modern 2048-bit or larger RSA remains safe from these specific exploits. Team named publicly: Dj Dvijotham, Abhradeep Thakurta, with Nadia Heninger and Emmanuel Thomé. Practical ask: inventory any remaining 1024-bit RSA in TLS, code-signing, VPN or legacy PKI and finish migrating it.

[← AI](/ai) · [markdown](/items/deepmind-ai-agents-legacy-rsa-1024-cryptanalysis-nov-6.md)

official (Google DeepMind / Pushmeet Kohli X announcement Nov 6); bounded to legacy 1024-bit RSA; modern 2048-bit+ claimed safe from these specific exploits

2026-11-06

### DeepMind: human-guided AI agents find faster signature-forgery and batch-factoring attacks on legacy RSA-1024

- **What it is not:** a break of current internet crypto. DeepMind repeatedly bounds the result to obsolete 1024-bit RSA.
- **Why it matters anyway:** AI shortens the historical 'years-to-decades' cadence of cryptanalytic advances — treat hardness margins as things you re-test, not permanent fixtures.
- **Read the numbers carefully:** the 1,600× figure is a theoretical estimate for a specific attacker-control case; the concrete sandbox measurement cited publicly is the 3.5× CPU saving on a known benchmark key.
- Primary pointer: DeepMind and Pushmeet Kohli's Nov 6 X posts / article; technical papers linked from that announcement.

Sources: [Google DeepMind on X: AI agents accelerate cryptanalysis; two weaknesses in legacy 1024-bit RSA (Nov 6)](https://x.com/GoogleDeepMind/status/2118755418675765656) · [Pushmeet Kohli: Advancing the frontier of cryptanalysis (X article, Nov 6)](https://x.com/pushmeet/status/2118752095859794390)