DeepMind Says Its AI Agents Redid a 1024-Bit RSA Signature Attack With 3.5 Times Less CPU Time. The Human on the Run Sent About 20 Messages.

On Friday, November 6, Google DeepMind's Pushmeet Kohli published an essay called "Advancing the frontier of cryptanalysis" and linked two working papers. The claim: AI agents, under human supervision, found two weaknesses in legacy 1024-bit RSA, an older key size of the public-key system long used to sign software and secure web connections.

The headlines went with the big multipliers, 1,600x and 30x. Those are theoretical estimates. The number I care about is smaller and was actually measured: 3.5. That is how much less CPU time DeepMind's agents needed to repeat a 1024-bit signature attack that human cryptographers had published just weeks earlier.

DeepMind is clear that this does not break modern RSA. Kohli's essay says "these results only affect obsolete 1024-bit RSA systems," and that 2048-bit and larger keys remain secure. Read it as a story about speed, not a broken lock.

The Attack Being Repeated

The baseline is a paper by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, "Forging 1024-bit RSA signatures in nearly SNFS time." The IACR ePrint archive lists it as received on Sunday, September 20, 2026 and approved on Tuesday, September 22.

It implemented a 2007 algorithm by Joux, Naccache and Thomé. An attacker who gets temporary access to a raw RSA signing interface can later forge signatures on chosen messages without ever recovering the private key. The team ran it against a hardware security module. By their own count it took 1,380 CPU core-years over five calendar months: about 1,200 for precomputation and 180 for each forged root after that.

Their conclusion was already sharp. With a signing oracle, they wrote, RSA's concrete security looks 15 to 30 bits lower than factoring-based estimates for key sizes from 1024 to 4096 bits. "Even 4096-bit RSA does not appear to meet a 128-bit security level in this attack model."

What the Agents Did

DeepMind's first paper reruns that attack on the same modulus, with the same algorithm, polynomials and factor-base bounds. Its first root took 391 CPU core-years: 318 for the offline phase and 73 for the root itself. That is 3.5 times less than the original. Each further root cost 73 core-years against 180.

The authors say plainly where the saving came from: "the factor of 3.5 is one of implementation and execution, not of algorithms." Most of it came from a faster siever, which they say is 1.8 to 4.4 times faster than the CADO-NFS siever on the same machine while finding the same relations. The linear algebra moved to GPUs.

The part that should get attention is who did the engineering. Two language-model agents, which the paper calls only Model A and Model B, ran the project. A supervisor wrote the design, set budgets and audited results. An executor wrote the code and ran the jobs. Neither paper names the models.

The paper's own tally, from the start of the design to the verified root, is 3 days and 22 hours. The agents wrote about 33,500 lines of new code, ran 336 distributed experiments and made 16,292 tool calls. The human researcher sent about 20 messages, which the paper says were mostly approvals such as "follow your recommendation" and "continue."

It was not clean. A 32-bit index overflow made the first computed root wrong, and the agents had to fix it during the run. The paper says the calendar gap, about four days against about five months, reflects mainly parallelism. Fair enough. Keeping a 300,000-core job correct without repeating its one-shot oracle batch is still the hard part.

The Two Theoretical Results

The same paper also answers an older question: how much does signature padding help? Kohli's summary: "Once they control roughly half of the block or more, padding adds no protection at all." In the paper's terms, the standard PKCS#1 v1.5 format is no harder to attack than a raw oracle once a caller supplies more than half a block of data, or a 64-byte digest such as SHA-512 at 1024 bits.

With a 32-byte digest such as SHA-256, the attack gets harder. There the paper lowers the cost exponent from 1.8171 to 1.5803. This is the result behind the 1,600x in Kohli's essay; by TensorFeed's arithmetic, the exponent change works out to roughly 1,640 times at 1024 bits at leading order. The paper calls the result asymptotic and says "we did not run it at this size."

The second paper, dated Thursday, November 5, is about factoring many keys of the same size. It gives each key its own family, or "fan," of number fields fed by one shared precomputation. With a precomputation budget of one full factorization, each further 1024-bit key costs about 1/58 of a factorization, 30 times less than Coppersmith's multiple number field sieve, whose exponent for this setting had stood since 1993. Its algebraic identities are machine-checked in Lean 4. It is also theoretical: the paper says "no fan factory has been implemented."

Caveats

The forgery needs direct calls to a signing interface with chosen inputs, about 4 billion of them in DeepMind's run, all made before the target is known. Devices that hash the message internally sit outside the model. And 1024-bit RSA is no longer approved for new signatures. The 391 core-years are also far below the cost of factoring the key, which the paper puts at 500,000 to 1,000,000 core-years.

The 3.5 times compares DeepMind's measured CPU time with costs Shea and colleagues measured on their own hardware. The paper addresses this with a same-machine siever comparison, but it is still a cross-lab comparison. Two of the September authors, Heninger and Thomé, are also co-authors on both DeepMind papers. Both are labeled working papers.

Our Take

The honest reading is that the agents beat their human predecessors at engineering, not at mathematics. That is not a small thing. Most real attacks are engineering: the algorithm exists, and the question is whether someone can build, tune and debug it at scale. Kohli's X post says the agents made two significant cryptographic advances "in just weeks." The September team took about five months of calendar time on the computation alone.

I would push back on one comforting line in the coverage. "2048-bit is safe" is true for these results. But the September paper had already argued that a signing oracle takes 15 to 30 bits off RSA's concrete security, even at 4096 bits. And in the fan paper's own table, the theoretical batch advantage over the multiple number field sieve grows with key size: about 99 times at 2048 bits against 30 at 1024. Those 2048-bit costs are still astronomically out of reach. The direction is the point.

Kohli writes that "we cannot treat cryptographic hardness as a fixed assumption." I agree, and I think the practical lesson is narrower and more urgent than the essay's tone. Anyone still running 1024-bit RSA behind an HSM that exposes a raw or caller-formatted signing call now has a shorter clock than planned. Everyone else should treat this as one more reason to finish the move off RSA during the post-quantum transition, which is what the September authors argued for.

The quieter story is the labor ratio. About 20 human messages for a 300,000-core cryptanalysis run is the most concrete number I have seen for how far agentic research has moved in security. Defenders get that leverage too. So does everyone else.

Three Signposts for the Next 60 Days

First, whether DeepMind or another group actually implements the 32-byte-digest algorithm at 1024 bits, turning the 1,600x estimate into a measured number. Second, whether anyone builds a fan factory, which would show whether the 30x survives real code. Third, whether DeepMind names the models behind Model A and Model B, and whether NIST, HSM vendors or certificate bodies change guidance for raw RSA signing mechanisms in response.

Sources: Pushmeet Kohli's essay, Kohli on X, DeepMind signature paper, DeepMind batch factoring paper, Shea et al., IACR ePrint 2026/2131, OfficeChai, Crypto Briefing, UC Today.