Google DeepMind announced on November 6, 2026, that human-guided artificial intelligence (AI) agents helped researchers make two advances in studying older 1024-bit RSA security systems. The work examines weaknesses in certain digital signature methods and a proposed way to reduce the cost of factoring large groups of RSA keys. However, the findings do not show that modern RSA encryption has been broken.
The researchers published two working papers examining different problems involving 1024-bit RSA keys. The first looks at how certain digital signing systems handle data supplied by users. The second proposes a mathematical method that could make it less expensive to factor many RSA keys of the same size after substantial preparation. According to the researchers, neither finding demonstrates a successful attack against deployed systems using 2048-bit or larger RSA keys.
RSA is a public-key cryptographic algorithm used for tasks such as digital signatures and establishing secure connections. It uses a public key and a private key, with security depending partly on the difficulty of solving certain mathematical problems. Larger RSA keys generally provide stronger protection against known attacks. TechBonafide’s guide to cryptographic algorithms in cybersecurity explains how these security methods help protect information and verify digital identities.
Google DeepMind’s research shows that AI agents can help security experts study these complex mathematical problems more quickly. Instead of completing every technical task manually, researchers used AI systems to develop code, run calculations, test different approaches, and identify problems during experiments.
In the first Google DeepMind working paper, researchers examined RSA digital signing systems that use a formatting method called PKCS#1 v1.5. Under specific attack conditions, a signing system that allows an attacker to control a sufficiently large portion of the submitted data may provide less protection than previously expected. However, the findings do not mean that every RSA digital signature can be forged or that ordinary signed documents are automatically vulnerable.
To test the first area of research, two cooperating AI agents repeated a previously published 1024-bit RSA signature-forgery calculation using an academic test case. The updated experiment required approximately 391 CPU core-years of computing work, compared with 1,380 CPU core-years in the earlier study. This represented a reduction of about 3.5 times in the reported computing effort. However, the researchers explained that the improvement mainly came from better software implementation and execution of the same underlying method, rather than a new algorithm that was 3.5 times faster.
The experiment was completed in approximately 3.2 days using a large amount of computing power. At peak usage, the researchers employed around 300,000 CPU cores and 16 graphics processing units (GPUs). Running many calculations at the same time helped shorten the overall experiment. This does not mean that an ordinary computer can break 1024-bit RSA keys or forge digital signatures within a few days. Instead, it demonstrates how AI agents can help coordinate complex computing tasks at a large scale.
The second Google DeepMind working paper introduces a proposed mathematical method called “fan factories” for factoring many RSA keys of the same size. After a major upfront computing process, the researchers estimate that factoring each additional 1024-bit key could be approximately 30 times less expensive than the best comparable older method. However, this improvement is based on mathematical estimates rather than measured results from a fully working system.
Researchers used a mathematical proof-checking tool called Lean 4 to verify important parts of the proposed method. However, they have not reported building and running a complete fan factory to demonstrate the estimated computing savings. Its actual performance in a real-world implementation therefore remains unproven.
Importantly, neither study demonstrates a practical break of deployed RSA systems using keys of 2048 bits or larger. The completed experiment involved a previously studied 1024-bit mathematical test case rather than an attack against real websites or user accounts. The findings apply to specific digital signing conditions and proposed mathematical methods for factoring multiple keys. They do not provide a universal way to defeat RSA encryption or prove that modern RSA systems have become insecure.
The research is particularly relevant to organizations still using older RSA keys in software, digital certificates, security devices, and signing applications. According to NIST’s key-management guidance, 1024-bit RSA provides no more than 80 bits of estimated security strength, while 2048-bit RSA provides approximately 112 bits. Organizations should identify outdated RSA configurations, review their security requirements, and plan upgrades to appropriately sized keys or supported modern cryptographic methods.
Google DeepMind’s findings highlight the growing role of artificial intelligence in cybersecurity research. AI agents can assist experts with writing code, examining complex mathematical problems, and testing possible security weaknesses under human supervision. This growing use of automation is also reflected in the development of AI-powered cybersecurity defenses, which can help organizations analyze suspicious activity and respond to emerging threats more efficiently.
Although AI-assisted research can help improve digital security, similar capabilities may also help malicious actors identify weaknesses in outdated systems. This wider concern is reflected in warnings about AI-powered ransomware risks to critical infrastructure, where AI could make existing cyberattack methods faster and more effective. However, Google DeepMind’s RSA research does not demonstrate that its AI agents were used to attack real systems or compromise user information.
Google DeepMind’s research highlights how human experts and AI agents can work together to examine complex security problems more efficiently. While the findings do not demonstrate an immediate threat to deployed 2048-bit or larger RSA systems, they reinforce the need to replace outdated cryptographic technology and regularly review existing security methods. As AI-assisted research improves, identifying weaknesses before attackers exploit them will remain an important part of protecting digital systems.
