Google DeepMind's AI agents sharpen two attacks on legacy 1024-bit RSA; the authors say RSA-2048 is not threatened

On November 6, 2026, Pushmeet Kohli of Google DeepMind announced two working papers written with Nadia Heninger (UC San Diego and Inria) and Emmanuel Thomé (Inria). The first covers forging RSA signatures when an attacker can make a device, such as a hardware security module, sign data of their choosing billions of times. It proves that PKCS1 v1.5 padding adds no protection once the caller controls more than about half of the signed block, or a 64-byte digest at 1024 bits. Two cooperating AI agents then reran a known 1024-bit forgery on the test instance of an earlier academic study: the first root took 391 CPU core-years instead of 1,380, about 3.5 times less, in 3.2 days on up to 300,000 CPU cores and 16 GPUs. A human researcher sent about twenty short messages and wrote no code.

The second paper is theoretical. It gives each key in a batch its own family of number fields fed by shared precomputed work. At leading order, with a precomputation that costs one standard factoring run, each further 1024-bit key would cost about 1/58 of a run, 30 times less than the best earlier method for that budget, whose exponent had stood since 1993. No such factory has been built and no keys were factored; a two-agent AI system produced and checked the proofs, with the algebra machine-checked in Lean 4. The 1,600x figure in the announcement is also an estimate, for signers that take a 32-byte digest. Both papers say deployed RSA of 2048 bits or more is not threatened.