On 6 November 2026, Google DeepMind said that AI agents, working under human supervision, found two weaknesses in legacy 1024-bit RSA. One cuts the cost of forging signatures by roughly 1,600x, according to Pushmeet Kohli's announcement. The other cuts the average cost of factoring each extra 1024-bit key in a large batch by about 30x (DeepMind). The verdict in the 1024-bit versus 2048-bit comparison is clear: 2048-bit and larger keys remain safe today, and any 1024-bit RSA key you still run should be retired this quarter.
The work was led by DJ Dvijotham and Abhradeep Thakurta at DeepMind with cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thome (Inria), building on a September 2026 IACR eprint on forging 1024-bit RSA signatures. Two working papers include "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS" (IACR-report coverage; Interesting Engineering).
There are two separate results:
The team did not attack live keys. Instead, two cooperating agents reproduced a known 1024-bit forgery from an earlier academic study. They used about 3.5x less CPU time: 391 CPU core-years instead of 1,380 (test details). The run took 3.2 days on up to 300,000 CPU cores and 16 GPUs. A human researcher sent about twenty short messages and wrote no code (source).
Those numbers show that the attack remains expensive. Hundreds of thousands of cores for several days is far beyond a casual attacker. The point is the direction of travel and the speed: according to the announcement, the team reached both results in weeks.
No. Kohli's statement says the results only affect obsolete 1024-bit RSA, and that modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure (source). NIST no longer approves 1024-bit RSA for creating signatures, yet old keys linger (source).
| 1024-bit RSA | 2048-bit RSA or larger | |
|---|---|---|
| Status | Obsolete, weakened by this work | Not affected by these results |
| Signature creation (NIST) | No longer approved | Acceptable |
| Risk from batch factoring | Higher, as precomputation is shared across many keys | Not shown by this research |
| Recommended action | Retire this quarter | Keep, and plan for ECDSA or Ed25519 where possible |
The batch result matters for operators with many old keys: an attacker who pays the precomputation once spreads it across the whole fleet, so a large set of forgotten 1024-bit keys is a worse target than one.
Typical places include servers that were never re-keyed, appliance firmware, code-signing setups and old PGP keyrings. The same neglect behind unpatched devices applies here, as in our coverage of Synology ransomware hitting outdated DSM and the Ivanti Connect Secure zero-days. Old infrastructure rarely gets audited until something forces the issue.
To check an SSH key, print its size:
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
ssh-keygen -l -f ~/.ssh/id_rsa.pub
The first number in the output is the key size in bits. For a TLS certificate:
openssl x509 -in cert.pem -noout -text | grep "Public-Key"
Look for Public-Key: (1024 bit). For a remote server, pipe the output of openssl s_client -connect host:443 into openssl x509 -noout -text. For PGP, gpg --list-keys shows the algorithm and size of each key.
authorized_keys and known_hosts files.
There is a tradeoff. Some embedded devices and old appliances cannot accept Ed25519 or larger RSA keys, so replacement may mean a firmware update or hardware refresh. Plan for that rather than discovering it during an incident.
Kohli framed the results as an illustration of how quickly AI agent systems can evaluate the mathematical hardness of the problems that underpin digital security, and presented the work as a contribution to the cryptanalysis community (source). Risk assessments that once took years of specialist effort may now take weeks, so deprecation schedules should be treated as deadlines, not suggestions.
This fits a wider pattern of agent systems doing real security work, from computer-use agents to vendors paying more for serious findings, as in OpenAI's quadrupled critical bug bounty payouts. Defenders and attackers both gain from the same tools.
Q: Is 1024-bit RSA broken?
A: No live key was broken and no keys were factored. Two attack-cost improvements were shown, 2048-bit keys are unaffected, and 1024-bit RSA remains obsolete.
Q: Do I need to replace my SSH keys?
A: Only if any are 1024-bit RSA. Check with ssh-keygen -l -f <keyfile>, and replace anything reporting 1024 bits with Ed25519 or RSA of 2048 bits or more.
Q: What did the AI agents actually do?
A: Guided by human researchers, they rediscovered and improved attack algorithms. They then reproduced a known 1024-bit forgery using about 3.5x less CPU time than the earlier study (DeepMind).
Q: Does this affect HTTPS and modern TLS?
A: Not directly. Modern protocols almost universally use 2048-bit or larger keys, which these results do not touch. Only old certificates with 1024-bit keys are exposed.
Q: Why does batch factoring make migration more urgent?
A: Because an attacker can pay the precomputation cost once and reuse it across many keys. Each additional 1024-bit key becomes cheaper to factor, so leaving many old keys in place raises the risk.
Q: How soon should I act?
A: Retire any 1024-bit RSA key this quarter. Start with an inventory, since you cannot replace keys you have not found.