DeepMind AI Agents 1024-bit RSA vs 2048-bit: Retire 1024

Google DeepMind reported that supervised AI agents found two weaknesses in legacy 1024-bit RSA, including a roughly 1,600x reduction in the cost of forging signatures and about a 30x cut in the average cost of factoring each additional 1024-bit key in a large batch. In a reproduction of a known forgery, two cooperating agents used 391 CPU core-years instead of 1,380, running 3.2 days on up to 300,000 CPU cores and 16 GPUs with a human sending about twenty short messages and writing no code. DeepMind's Pushmeet Kohli said the results affect only obsolete 1024-bit keys and that 2048-bit and larger keys remain secure, while recommending operators retire 1024-bit RSA this quarter.

On 6 November 2026, Google DeepMind said that AI agents, working under human supervision, found two weaknesses in legacy 1024-bit RSA. One cuts the cost of forging signatures by roughly 1,600x, according to Pushmeet Kohli's announcement https://x.com/pushmeet/status/2118752095859794390 . The other cuts the average cost of factoring each extra 1024-bit key in a large batch by about 30x DeepMind https://x.com/pushmeet/status/2118752095859794390 . The verdict in the 1024-bit versus 2048-bit comparison is clear: 2048-bit and larger keys remain safe today, and any 1024-bit RSA key you still run should be retired this quarter. The work was led by DJ Dvijotham and Abhradeep Thakurta at DeepMind with cryptographers Nadia Heninger UC San Diego and Inria and Emmanuel Thome Inria , building on a September 2026 IACR eprint on forging 1024-bit RSA signatures. Two working papers include "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS" IACR-report coverage https://iacompa.com/news/2026-11-06-google-deepmind-ai-agents-legacy-rsa-1024-cryptanalysis ; Interesting Engineering https://interestingengineering.com/ai-robotics/google-deepmind-agents-expose-older-encryption-flaws . There are two separate results: The team did not attack live keys. Instead, two cooperating agents reproduced a known 1024-bit forgery from an earlier academic study. They used about 3.5x less CPU time: 391 CPU core-years instead of 1,380 test details https://iacompa.com/news/2026-11-06-google-deepmind-ai-agents-legacy-rsa-1024-cryptanalysis . The run took 3.2 days on up to 300,000 CPU cores and 16 GPUs. A human researcher sent about twenty short messages and wrote no code source https://iacompa.com/news/2026-11-06-google-deepmind-ai-agents-legacy-rsa-1024-cryptanalysis . Those numbers show that the attack remains expensive. Hundreds of thousands of cores for several days is far beyond a casual attacker. The point is the direction of travel and the speed: according to the announcement, the team reached both results in weeks. No. Kohli's statement says the results only affect obsolete 1024-bit RSA, and that modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure source https://x.com/pushmeet/status/2118752095859794390 . NIST no longer approves 1024-bit RSA for creating signatures, yet old keys linger source https://iacompa.com/news/2026-11-06-google-deepmind-ai-agents-legacy-rsa-1024-cryptanalysis . | | 1024-bit RSA | 2048-bit RSA or larger | |---|---|---| | Status | Obsolete, weakened by this work | Not affected by these results | | Signature creation NIST | No longer approved | Acceptable | | Risk from batch factoring | Higher, as precomputation is shared across many keys | Not shown by this research | | Recommended action | Retire this quarter | Keep, and plan for ECDSA or Ed25519 where possible | The batch result matters for operators with many old keys: an attacker who pays the precomputation once spreads it across the whole fleet, so a large set of forgotten 1024-bit keys is a worse target than one. Typical places include servers that were never re-keyed, appliance firmware, code-signing setups and old PGP keyrings. The same neglect behind unpatched devices applies here, as in our coverage of Synology ransomware hitting outdated DSM https://dev.to/articles/synology-c3rb3r-ransomware-outdated-dsm and the Ivanti Connect Secure zero-days https://dev.to/articles/ivanti-connect-secure-3-zero-days-patched-cisa-deadline . Old infrastructure rarely gets audited until something forces the issue. To check an SSH key, print its size: ssh-keygen -l -f /etc/ssh/ssh host rsa key.pub ssh-keygen -l -f ~/.ssh/id rsa.pub The first number in the output is the key size in bits. For a TLS certificate: openssl x509 -in cert.pem -noout -text | grep "Public-Key" Look for Public-Key: 1024 bit . For a remote server, pipe the output of openssl s client -connect host:443 into openssl x509 -noout -text . For PGP, gpg --list-keys shows the algorithm and size of each key. authorized keys and known hosts files. There is a tradeoff. Some embedded devices and old appliances cannot accept Ed25519 or larger RSA keys, so replacement may mean a firmware update or hardware refresh. Plan for that rather than discovering it during an incident. Kohli framed the results as an illustration of how quickly AI agent systems can evaluate the mathematical hardness of the problems that underpin digital security, and presented the work as a contribution to the cryptanalysis community source https://x.com/pushmeet/status/2118752095859794390 . Risk assessments that once took years of specialist effort may now take weeks, so deprecation schedules should be treated as deadlines, not suggestions. This fits a wider pattern of agent systems doing real security work, from computer-use agents https://dev.to/articles/cua-master-27b-best-open-computer-use-agent to vendors paying more for serious findings, as in OpenAI's quadrupled critical bug bounty payouts https://dev.to/articles/openai-bug-bounty-quadrupled-critical-payouts-2026 . Defenders and attackers both gain from the same tools. Q: Is 1024-bit RSA broken? A: No live key was broken and no keys were factored. Two attack-cost improvements were shown, 2048-bit keys are unaffected, and 1024-bit RSA remains obsolete. Q: Do I need to replace my SSH keys? A: Only if any are 1024-bit RSA. Check with ssh-keygen -l -f <keyfile , and replace anything reporting 1024 bits with Ed25519 or RSA of 2048 bits or more. Q: What did the AI agents actually do? A: Guided by human researchers, they rediscovered and improved attack algorithms. They then reproduced a known 1024-bit forgery using about 3.5x less CPU time than the earlier study DeepMind https://iacompa.com/news/2026-11-06-google-deepmind-ai-agents-legacy-rsa-1024-cryptanalysis . Q: Does this affect HTTPS and modern TLS? A: Not directly. Modern protocols almost universally use 2048-bit or larger keys, which these results do not touch. Only old certificates with 1024-bit keys are exposed. Q: Why does batch factoring make migration more urgent? A: Because an attacker can pay the precomputation cost once and reuse it across many keys. Each additional 1024-bit key becomes cheaper to factor, so leaving many old keys in place raises the risk. Q: How soon should I act? A: Retire any 1024-bit RSA key this quarter. Start with an inventory, since you cannot replace keys you have not found.