Google DeepMind’s AI Agents Found Two Weaknesses in Old RSA Encryption — and Your Bank Account Is Still Safe

Artificial intelligence has just found two cracks in one of the oldest locks on the internet — and the good news is that the lock it broke is one your bank stopped using years ago.

On 6 November 2026, Google DeepMind announced that its AI agents had discovered two previously unknown weaknesses in 1024-bit RSA encryption, a legacy form of security still used to protect some old systems. The findings were announced by DeepMind’s vice president of research, Pushmeet Kohli, on X, and published in two technical papers.

RSA encryption is the invisible machinery behind much of the internet: it protects online banking, secure messages, and software updates. The new findings do not mean your passwords or bank account are suddenly at risk. But they do show that AI is becoming a powerful tool for finding flaws in the cryptographic systems the world relies on — and that old systems need to be retired faster.

This article explains what RSA is, what DeepMind’s AI found, and what it means for you.

What is RSA encryption, in simple words?

RSA is a way of locking information so that only the intended recipient can unlock it. It was invented in 1977 and named after its three creators: Rivest, Shamir, and Adleman.

Here is the simple version. RSA uses two keys:

• A public key, which anyone can use to lock a message.
• A private key, which only the owner has, and which unlocks the message.

The security comes from maths. The public key contains a very large number, made by multiplying two huge prime numbers together. Anyone can see the large number, but working out which two primes it was made from is so difficult that even the fastest computers would take centuries. The private key is built from those two secret primes.

The size of the key is measured in bits. A 1024-bit key was the standard for many years. Today, the standard is 2048-bit or higher — keys that are much, much harder to break. A 1024-bit key is like a padlock from the 1990s: it was strong in its day, but the world has moved on to better locks.

RSA is used in digital signatures (which prove a message or piece of software really came from who it claims to be from), in secure web connections, and in email encryption.

What did DeepMind’s AI agents actually find?

DeepMind’s AI agents — autonomous systems that can plan and carry out research tasks — found two weaknesses in how 1024-bit RSA works in practice. The work was led by Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger (University of California, San Diego and Inria) and Emmanuel Thomé (Inria) — two of the world’s leading cryptographers, who had already published a related paper in September 2026.

The two weaknesses are different, but both make 1024-bit RSA easier to attack than anyone realised.

Weakness 1: Forging digital signatures is easier than thought

The first weakness affects digital signatures — the cryptographic stamps that prove a message or piece of software is genuine.

RSA signatures use a system called “padding” to format the message before it is signed. Padding is meant to add randomness and structure so that attackers cannot forge signatures. DeepMind’s agents found that the padding stops protecting the signature once an attacker controls about half of the signed block — a much lower threshold than previously assumed.

In practical terms, this means an attacker who can influence part of a signed message has a much easier path to forging a signature than the textbooks suggested. The researchers developed a new algorithm that can forge 1024-bit RSA signatures about 1,600 times faster than the previous best method for certain cases (for 32-byte fingerprints — a theoretical estimate).

This does not mean all RSA signatures are broken. The weakness applies to legacy 1024-bit keys and specific signature formats. Modern 2048-bit keys, with proper padding, are not affected.

Weakness 2: Cracking many keys at once gets cheaper

The second weakness is about scale. Normally, breaking one RSA key costs a certain amount of computing power, and breaking ten keys costs ten times as much. DeepMind’s agents found a way to make the cost of each additional key much lower.

The technique, called “batch factoring”, lets an attacker break many 1024-bit RSA keys at once, with each extra key costing only about 1/30th of the first one. In the researchers’ sandbox reproduction, the whole process used 3.5 times less CPU time and less than 1/1000th of the computing power that would be needed to factor a single key by brute force.

That matters because the internet still contains millions of old 1024-bit keys — in old software, embedded devices, and legacy systems. An attacker who can break many keys cheaply at once has a much bigger target to aim at.

Why 1024-bit RSA is the target — and why it is already retired

It is no accident that DeepMind’s agents went after 1024-bit RSA. It is the weakest version of RSA still in use, and the cryptography world has been trying to retire it for years.

The US National Institute of Standards and Technology (NIST) has not approved 1024-bit RSA for new digital signatures since 2013. Modern guidance says new systems should use at least 2048-bit keys — and many systems now use 3072-bit keys or newer algorithms entirely.

But old keys linger. They sit in devices that are rarely updated, in software that was written years ago, and in systems where nobody has gone back to check what encryption is actually being used. That is why findings like this matter: they put a price on leaving old cryptography in place.

Heninger and Thomé’s September 2026 paper, “Forging 1024-bit RSA signatures in nearly SNFS time”, laid the mathematical groundwork for the first weakness. The DeepMind work built on it, using AI agents to explore the attack in practice — with only about 20 human guidance messages and under four days of work.

How the AI agents did the work

The research is notable not just for what it found, but for how it was done.

DeepMind’s AI agents were given a goal — find weaknesses in 1024-bit RSA — and allowed to plan their own approach. They searched through mathematical literature, tested hypotheses, wrote code, and ran experiments, with human researchers stepping in only about 20 times to guide them.

The whole process took less than four days.

That speed is the real story. Cryptography research that might have taken a team of experts months or years was compressed into days by AI agents working with minimal supervision. It suggests that AI will soon be a standard tool for testing the security of the systems we all depend on — finding flaws faster than human researchers alone could.

DeepMind published two technical papers describing the work, so that other researchers can check the findings and build on them. The company also notified the relevant standards bodies before going public, following the normal practice of responsible disclosure.

Does this affect your online banking, messages or passwords?

Almost certainly not — and here is why.

Your bank, your email provider, and the websites you visit every day do not use 1024-bit RSA. They use 2048-bit keys or stronger, and many have moved to entirely different, newer encryption methods. The weaknesses DeepMind found apply specifically to legacy 1024-bit keys.

What should you actually do? Nothing different from what you should already be doing:

• Keep your software and apps updated — updates replace old cryptography with new.
• Use a password manager and two-factor authentication, which protect you even if one layer of security fails.
• Be wary of very old devices and software that no longer receive updates — these are the places where 1024-bit keys are most likely to still be lurking.

The finding is a warning to organisations, not to individuals. Companies and governments that still run old systems with 1024-bit RSA should upgrade now — the cost of staying on legacy encryption has just gone up.

What happens next?

The findings will now be reviewed by the wider cryptography community. Other researchers will check the maths, try to reproduce the results, and work out exactly which systems are affected.

Standards bodies are likely to accelerate the retirement of 1024-bit RSA. NIST already discourages its use; the new results give that guidance fresh urgency. Organisations that have been slow to upgrade will face new pressure to do so.

DeepMind’s work also points to a bigger shift: AI agents are becoming capable research partners in cryptography. The same approach could be used to test other encryption systems — including the newer algorithms designed to resist quantum computers. Finding flaws before attackers do is one of the most valuable things AI can do for security.

For now, the message is simple. The lock DeepMind broke was an old one, and the world has better locks already. The challenge is making sure every system actually uses them.

Frequently asked questions

What is RSA encryption?

RSA is a widely used method of securing digital information, invented in 1977. It uses a public key to lock a message and a private key to unlock it. The security relies on the difficulty of factoring very large numbers. RSA is used in digital signatures, secure web connections, and email encryption.

What did DeepMind’s AI agents find?

They found two previously unknown weaknesses in legacy 1024-bit RSA encryption. First, digital signatures can be forged about 1,600 times faster than previously thought in certain cases, because the padding stops protecting the signature once an attacker controls about half of the signed block. Second, a technique called batch factoring makes it about 30 times cheaper to break each additional 1024-bit key once the first one is broken.

Does this mean my bank account is at risk?

No. Banks and major websites use 2048-bit RSA keys or stronger — not the legacy 1024-bit keys affected by these findings. Modern encryption is not affected.

What is 1024-bit RSA, and why is it still used?

1024-bit RSA was the standard key size for many years, but NIST has not approved it for new digital signatures since 2013. It still lingers in old software, embedded devices, and legacy systems that are rarely updated.

How did the AI agents do the research?

DeepMind’s AI agents were given the goal of finding weaknesses in 1024-bit RSA and planned their own approach, with only about 20 human guidance messages. The whole process took under four days. The work was led by Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger and Emmanuel Thomé.

What should organisations do now?

Any organisation still using 1024-bit RSA should upgrade to 2048-bit keys or stronger as soon as possible. The findings show that the cost of attacking legacy keys is lower than previously thought, so leaving old cryptography in place is riskier than it seemed.

Sources

• https://interestingengineering.com/science/deepmind-ai-agents-rsa-encryption-flaws
• https://cryptobriefing.com/deepmind-ai-rsa-1024-vulnerabilities/
• https://www.webpronews.com/google-deepmind-ai-agents-discover-rsa-encryption-weaknesses/
• https://letsdatascience.com/google-deepmind-ai-rsa-encryption/
• https://officechai.com/ai/google-deepmind-ai-agents-found-two-weaknesses-in-old-rsa-encryption/
• https://explainx.in/google-deepmind-ai-agents-found-two-weaknesses-in-old-rsa-encryption/

This article is for general information and education only. It is not legal or financial advice.