On November 6, 2026, Google DeepMind released two papers on RSA, the encryption behind many digital signatures. In the first paper, two AI agents reran an academic team’s September attack that forges 1024-bit RSA signatures. Their human overseer sent “about 20” messages, “mostly approvals such as ‘follow your recommendation’ and ‘continue’.”
The agents used 3.5 times less computing time than the September team. They took under four days against about five months, mostly by running far more processors at once.
The second paper, dated November 5, covers factoring, the math problem behind breaking RSA keys. By the authors’ theoretical estimates, each extra same-size key costs 30 times less than with the best previous method.
Both papers say they do not threaten systems with longer keys of 2048 bits or more. NIST, the U.S. standards agency, no longer approves 1024-bit keys for generating signatures. Both are working papers, not yet peer reviewed.
The September attack and the rerun
The attack comes from a paper by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé of UC San Diego and Inria, France’s national computer science institute. It appeared September 22 on ePrint, the International Association for Cryptologic Research’s public paper archive.
The team ran a 2007 algorithm by Joux, Naccache and Thomé. An attacker with temporary access to a signing device, which holds a key and signs on request, has it sign billions of chosen values. That lets the attacker forge a signature on any message without learning the key. The device was a hardware security module, a tamper-resistant key-storage box.
The attack “took 1380 CPU core-years over five calendar months,” the authors write. A core-year is one processor core running for a year.
DeepMind’s agents reused the same key and mathematical settings (polynomials and bounds). Their first computed root, in effect a forged signature, took 391 CPU core-years instead of 1,380. “The factor of 3.5 is one of implementation and execution, not of algorithms,” the paper says.
Most of that gain came from faster sieving, the step that sifts huge numbers of candidates. On the same machine, the agents’ version of the sieve in CADO-NFS, open-source factoring software the September team used, ran 1.8 to 4.4 times faster than the original.
The calendar gain has another cause. The run took 3.2 days from the first full-scale sieving job to the verified root, peaking at about 300,000 CPU cores and 16 GPUs (graphics chips). It averaged about 45,000 busy cores, against about 3,300 for the September team. The authors attribute the gap “mainly” to that parallelism: “We do not count it as an efficiency gain.”
A supervisor, an executor and a human who approved
Two unnamed AI models split the work. Model A, the supervisor, wrote the design, set a budget and a check for every stage and reviewed each result. Model B, the executor, wrote and tested the code, ran jobs on a shared computer cluster and fixed failures.
In the 3 days and 22 hours from design to verified root, the agents wrote 33,500 lines of new code. They ran 336 multi-machine experiments, made 16,292 tool calls (actions such as running a command) and exchanged 218 messages.
The human researcher “set the goal and approved the gates,” the paper says. These included the conditions for the two irreversible steps: drawing the target, the random value whose signature had to be computed, and sending the queries to the simulated signer, a separate program that alone held the key. The supervisor agent gave the final go-ahead. The paper adds: “The researcher wrote no code, launched no job and diagnosed no fault.”
Each stage ran first as a small probe and scaled up only after passing preset checks. The final phase was rehearsed on a smaller, 498-bit key.
At full size, the agents still hit “a 32-bit index overflow that made the first computed root wrong.” A position counter too small for the data had wrapped around. The final check caught it, the agents fixed it, and the query batch needed no repeat.
The batch-factoring paper and a harder signature case
The second paper is about breaking many same-size keys. With a shared precomputation that costs about one factorization, the best known cost per extra key had not improved since 1993, the authors note.
The new method gives each target key its own number fields, the algebraic structures the sieve works in. Each further 1024-bit key then costs about 1/58 of factoring it alone with the standard number field sieve, the paper estimates. That is “30 times less” than with the previous best method. The authors call these “theoretical estimates” that “do not predict running times.”
The algebra behind them is machine-checked in Lean 4, proof-checking software, and “one model generated the proofs, and a second model verified them,” the authors write. Lean 4 also checked a startup’s claimed proof of an 18-year-old quantum conjecture, announced November 6.
The signature paper also proves a threshold. Signing standards pad a message into a set format before signing. Once an attacker controls about half of the signed block, that format “stops mattering” and the attack above applies. A short 32-byte digest, the message’s fingerprint, leaves a harder problem.
For that case, Pushmeet Kohli, Google DeepMind’s vice president for science, wrote on X that a new algorithm “according to our theoretical estimates, improves on the previous best method by roughly 1,600x for 1024-bit keys.” The signature paper says that case “has not been run at any cryptographic size.”
Earlier AI-assisted factoring in September
On September 9, Eric Lu of Cognition wrote that he “drove a bevy of Devins,” the company’s coding agents, to factor RSA-260. It is a 260-digit RSA Factoring Challenge number. He called it a record at the time for the largest challenge number solved in public.
His agents built a GPU sieve that he says factors “at 10x lower cost than the previous public state of the art.” Lu estimates that hyperscalers, the biggest cloud providers, or frontier AI labs “could likely factor RSA-1024 numbers at a cost on the order of $30 million per number.” He adds: “RSA-2048 remains roughly a billion times harder.”
On September 19, Stephen A. Weis factored RSA-896, a 270-digit challenge number, “with Claude,” Anthropic’s AI model. Claude adapted CADO-NFS to GPUs and ran it on up to 2,048 idle Anthropic GPUs over 10 days. Weis writes that this did not meaningfully speed up the underlying algorithm. He argues it shows that 1024-bit keys “are vulnerable to many actors with data center-level fleets of GPUs.”
By Devin’s own count, Lu sent 3,328 messages across 192 of the 233 sessions, over about three weeks of building a GPU version of CADO-NFS. That was a different job from DeepMind’s four-day rerun, so the drop to about 20 messages illustrates the change without measuring it.
What the papers do not show
Nobody factored a 1024-bit RSA key. The paper, citing the September team, puts factoring this key at 500,000 to 1,000,000 core-years; the agents’ first root cost 0.04% to 0.08% of that. Kohli calls the test “a sandboxed simulation” on “an already-solved 1024-bit benchmark key from an earlier academic study.”
The 3.5 factor compares DeepMind’s measured CPU time with costs the September team reported on other hardware. The same-machine sieve test caps the hardware’s share at a factor of 1.5 on one sieving stage and 1.2 on the other. The 30x and 1,600x figures are theoretical, and the 1,600x case has not been run.
The attack also assumes a device that signs inputs chosen by the caller, about 4 billion times in this run. Devices that hash the message into a digest themselves are outside the model, the paper notes.
Heninger and Thomé, two of the September paper’s five authors, co-wrote both DeepMind papers. We found no public comment from an outside cryptographer by November 8.
What it means
Two DeepMind agents did the slow engineering of cryptanalysis, or code-breaking, in under four days on up to 300,000 cores. The human set the goal and approved the conditions for the irreversible steps.
“Historically, major advances in this kind of work take years or decades,” Kohli writes, so defenders “could assume hardness margins changed only slowly.” His conclusion: “we cannot treat cryptographic hardness as a fixed assumption.” Other agent-run security work points the same way, such as OpenAI’s report that an unreleased model found 948 Linux kernel flaws.
The September team had already read its own result as “classical cryptanalytic evidence in favor of moving away from RSA entirely during the current post-quantum transition.” Classical means on ordinary computers; post-quantum means quantum-resistant.
NIST’s final report IR 8547, published October 27, says the agency “will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035,” RSA signatures included. Those dates were set with quantum computers in mind, and the September and November papers add classical evidence to the case for meeting them.
Three things to watch: an outside review of the two working papers, an attempt at the harder 32-byte case at real key sizes, and whether DeepMind releases the faster sieve. The paper says its sieve improvements “carry over to any CADO-NFS computation” but is silent on publishing the code.
Sources
- Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation, Google DeepMind (working paper), November 6, 2026
- Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS, Google DeepMind (working paper), November 5, 2026
- Advancing the frontier of cryptanalysis, Pushmeet Kohli on X, November 6, 2026
- Forging 1024-bit RSA signatures in nearly SNFS time, Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, IACR Cryptology ePrint Archive, September 22, 2026
- Factoring RSA-260, Eric Lu, Cognition, September 9, 2026
- RSA-896, Stephen A. Weis, September 2026
- Transition to Post-Quantum Cryptography Standards (IR 8547), NIST, October 27, 2026
Header image: chart by MACCUS, data from Shea et al. (IACR ePrint 2026/2131, September 22, 2026) and Google DeepMind (working paper, November 6, 2026)
