Did AI break RSA? It accelerated two attacks on legacy 1024-bit settings—not modern 2048-bit encryption
DeepMind agents helped reproduce a restricted signature attack in 391 CPU core-years and derive a cheaper theoretical method for factoring many same-size keys. Both papers are working drafts, and neither demonstrates a break of today's mainstream RSA deployments.
The short version
- What happened
- On one previously solved 1024-bit benchmark, two agents implemented the same unrestricted-oracle attack in 391 CPU core-years, versus 1,380 reported previously; the gain was engineering and execution, not a new algorithm.
- Who it affects
- Security engineers should treat the work as support for completing legacy-key inventories and limiting powerful signing interfaces, not as evidence that current 2048-bit certificates have been broken.
- What remains unproven
- Both papers are working drafts released by the organisation that developed the AI-agent system; neither is peer reviewed or independently replicated.
Keep in mind
Both papers are working drafts released by the organisation that developed the AI-agent system; neither is peer reviewed or independently replicated.
The measured computation used one previously solved 1024-bit benchmark modulus, the same algorithm and an unrestricted signing oracle in a sandbox—not a live deployment.
The affine result proves and analyses a query model; it does not identify a vulnerable production device or measure real request controls, key rotation or detection.
The fan-factory improvement is asymptotic and heuristic. It has not been implemented, and its 1024-bit ratios omit lower-order terms, constants and practical storage costs.
The papers state that 2048-bit and larger RSA systems are not affected by these specific results; no inference about every implementation or future attack should be made from that assurance.
Multi-source analysis · 3 linked sources. Primary analysed source date: 6 November 2026. Earliest linked supporting source: 5 November 2026.
Read the full report · 9 min The evidence, methods, implications and limitations
The direct answer: AI accelerated legacy cryptanalysis, but it did not break modern RSA
Google DeepMind has released two working papers describing human-guided AI agents that improved research on attacks against legacy 1024-bit RSA settings. The most concrete result is an implementation: two cooperating agents reproduced an earlier signature-forgery computation on the same already solved 1024-bit benchmark modulus in 391 CPU core-years, compared with 1,380 core-years reported by the earlier team. The second result is theoretical: a new way to share precomputation when factoring many integers of the same size lowers the asymptotic cost per additional target under standard number-field-sieve heuristics.
Neither result is a demonstrated break of ordinary modern encryption. Both papers state that deployed cryptosystems using 2048-bit or larger RSA are not threatened by these specific attacks. The measured job ran in a sandbox, used a retired 1024-bit test instance and assumed temporary access to a signing oracle that returns roots for chosen inputs. The factory result was not implemented at all. That combination makes the work consequential research for cryptographers and standards teams, but not an urgent incident requiring the public to change passwords or certificates tonight.[1][2][3]
What the measured 391-core-year experiment actually tested
The first paper studies modular roots when an attacker can query a signing or decryption device during an offline phase, then loses access and must forge roots for new random targets. Its unrestricted-oracle experiment repeats the algorithm, modulus, polynomials and factor-base bounds used by Shea and colleagues in a 2026 computation. DeepMind reports 318 CPU core-years for the offline phase and 73 for the online phase, totalling 391. The earlier implementation reported 1,200 and 180 respectively. Factoring the same modulus directly was estimated at 500,000 to one million core-years.
The 3.5-fold saving is therefore an implementation comparison, not a 3.5-fold improvement in the mathematical attack. The authors attribute it mainly to faster sieving code and cheaper descent and root-extraction strategies within the same algorithm. They report using as many as 300,000 CPU cores and 16 GPUs, completing the full-scale run in 3.2 calendar days. Massive parallelism explains much of the elapsed-time difference from the earlier five-month run; core-years, not wall-clock days, are the fairer compute denominator.[1]
The distinction that matters
Three claims that should not be collapsed into one headline
The release combines a measured implementation, a proof about interface freedom and an unimplemented asymptotic algorithm.
Measured
Re-run one solved 1024-bit oracle attack
391 CPU core-years
Proved
Analyse caller-controlled signing formats
Half-block threshold
Estimated
Share work across many same-size targets
About 30× at leading order
Not shown
Attack mainstream 2048-bit RSA
Outside demonstrated scope
The agents wrote and repaired the system, while a human approved checkpoints
The paper describes a two-agent harness. A supervisor model wrote the design, set checkpoints and audited results; an executor wrote code, launched distributed jobs and repaired failures. The authors say the agents produced about 33,500 lines of new code and ran 336 distributed experiments. A human researcher sent roughly twenty short messages, mostly approvals. During the run, the agents addressed descent nodes that the existing siever abandoned and a 32-bit index overflow that made the first computed root wrong. The paper presents those repairs as evidence that the agents handled problems hidden by smaller rehearsals.
Those numbers show substantial engineering autonomy inside a tightly defined mathematical project, but they do not isolate the AI contribution from the infrastructure, prior algorithm, human-selected objective or expert collaborators. The authors are primarily affiliated with Google DeepMind, with collaborators also affiliated with UC San Diego, Stanford and Inria. The papers disclose no independent replication or peer review. Releasing code, exact job logs and reproducible artefacts would allow outside cryptographers to distinguish model-driven advances from optimised implementation and abundant compute.[1]
Restricted signing formats matter, and the attacker still needs a powerful oracle
Real signing interfaces normally add a fixed format rather than accepting arbitrary mathematical inputs. The paper models this as an affine oracle: the device signs a fixed component plus a caller-controlled portion. It proves that when the controllable window contains roughly the square root of all possible residues, two allowed queries can simulate one unrestricted query after a small average number of re-randomisations. At 1024 bits, the authors measured 1.26 re-randomisations when the variable part covered exactly half the modulus bits.
Applied to the PKCS#1 v1.5 formatting used by a PKCS#11 signing mechanism, the analysis says more than about half a block of caller-controlled data—or a 64-byte digest at 1024 bits—removes the extra hardness supplied by the fixed format. A 32-byte digest remains in the harder affine regime. This is a statement about the freedom an interface grants an attacker, not evidence that any named hardware security module or production service is exploitable. An attacker would still need temporary oracle access and billions of chosen queries in the underlying line of work, while key rotation, request limits and implementation constraints can change feasibility.[1]
The fan-factory result is mathematically important but not a measured 30-fold speed-up
The second working paper asks what happens when an adversary wants to factor many integers of the same size. Traditional factorisation factories share a large rational-side precomputation across targets, while multiple number-field sieve methods give each target several algebraic fields. The new proposal combines those ideas: each target receives its own fan of number fields, all fed by a shared precomputed rational side. Under standard heuristic analyses, one precomputation with the asymptotic cost of a general number-field-sieve run reduces the exponent for each further target from 1.9019 to 1.7929.
At 1024 bits, setting lower-order terms to zero yields an estimated per-target cost about one fifty-eighth of one ordinary factorisation, or roughly 30 times lower than the previous multiple-field method after the shared upfront work. That is not a benchmark result. No fan factory was built, the hidden constants and real hardware costs are unknown, and the required stored table is estimated at an impractical leading-order size. The authors machine-checked algebraic identities and feasibility witnesses in Lean 4, which strengthens the derivation without validating practical performance.[2]
What security teams should do—and what would change this assessment
Organisations should not interpret this announcement as a reason to abandon correctly deployed 2048-bit RSA overnight. They should already be inventorying cryptographic assets, removing legacy 1024-bit keys, constraining raw signing interfaces and planning migration toward approved post-quantum standards. The research adds a reason to test assumptions continuously: AI agents may compress the engineering cycle between a mathematical idea and a large computation. That matters especially for long-lived systems, hardware devices and archives whose security choices are expensive to replace.
The assessment would become more serious if independent teams reproduce the 391-core-year computation, implement the affine algorithm below the half-block threshold or build a fan factory whose measured cost matches the asymptotic promise. A demonstrated attack on 2048-bit RSA, a widely deployed protocol with realistic query access, or a disclosed production compromise would alter the urgency immediately. For now, the responsible conclusion is narrower: AI-assisted teams improved the speed and scope of research on retired RSA parameters, while the evidence itself says modern mainstream RSA remains outside the demonstrated attack.[1][2][3]
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Continue the story
Read next
Continue exploring cybersecurity: compare the finding and its evidence limits.
An internal Claude model built five exploit chains; the disclosed flaws were patched before publication
Anthropic says its red team used an unreleased model to combine vulnerabilities across Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm shipped fixes, but the programme was company-run and does not measure how often other models or attackers can repeat the work.
Read the next reportExplore the full source and evidence record
What this means for people
- Security engineers should treat the work as support for completing legacy-key inventories and limiting powerful signing interfaces, not as evidence that current 2048-bit certificates have been broken.
- Cryptographers may face a faster research cycle as agents turn theoretical ideas into large experiments, increasing the value of reproducible code, independent review and continuously updated standards.
- Public-service and critical-infrastructure teams need migration plans that distinguish old key sizes from current systems so alarming headlines do not trigger disruptive, unnecessary emergency changes.
Global context
RSA-1024 has long been considered inadequate for new systems, while security guidance has pushed organisations toward larger keys and post-quantum migration. The new work does not reverse that chronology; it uses retired parameters as a safe proving ground for how AI can alter cryptanalytic research. Its international relevance lies in uneven infrastructure. Some governments, industrial devices and archives may retain legacy keys longer than well-resourced cloud services, while cryptographic migration capacity varies sharply. Clear scoping prevents a research advance from becoming either panic about modern encryption or complacency about older assets.
What the evidence does not yet show
- Both papers are working drafts released by the organisation that developed the AI-agent system; neither is peer reviewed or independently replicated.
- The measured computation used one previously solved 1024-bit benchmark modulus, the same algorithm and an unrestricted signing oracle in a sandbox—not a live deployment.
- The affine result proves and analyses a query model; it does not identify a vulnerable production device or measure real request controls, key rotation or detection.
- The fan-factory improvement is asymptotic and heuristic. It has not been implemented, and its 1024-bit ratios omit lower-order terms, constants and practical storage costs.
- The papers state that 2048-bit and larger RSA systems are not affected by these specific results; no inference about every implementation or future attack should be made from that assurance.
What to watch next
- Independent cryptographic review and reproduction of the 391-core-year computation.
- Publication of code, prompts, job traces and failure logs sufficient to audit the claimed agent autonomy.
- Practical implementation of the affine attack below the half-block threshold and measurement against realistic signing controls.
- Any implementation of the fan factory, including storage, hardware and lower-order costs.
- Updated guidance from standards bodies if AI-assisted results materially change accepted security margins.
Living evidence record
Impact record IAI-1V3TD81
Evidence stage
Studied
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
7 November 2026
Source trail
3 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 7 November 2026
Research question, topics and regions
Whether human-guided AI agents can improve attacks on restricted RSA signing interfaces and reduce the amortised cost of factoring many legacy 1024-bit keys
Topics: Cryptography · RSA · AI agents · Cybersecurity · Research automation · Working paper
Regions: United Kingdom · United States · France · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.