Google DeepMind finds two weaknesses in legacy 1024-bit RSA encryption

Google DeepMind's AI models, working under human direction, have uncovered two weaknesses in legacy 1024-bit RSA encryption. The findings, announced November 6, 2026, show that attacking these older systems may require far less computing effort than cryptographers previously assumed - though modern 2048-bit deployments remain secure against this specific threat.

What the research uncovered

The first vulnerability enables the forgery of digital signatures, which function like a wax seal on a letter to prove sender identity and detect tampering. The second finding is a new algorithm that lowers the cost of batch factoring for related moduli. RSA security depends on the difficulty of working backward from the product of two large prime numbers - called the modulus - to find those original primes. Batch factoring attacks many moduli at once, and when those moduli share certain relationships, DeepMind's algorithm makes the group attack cheaper.

The work was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, in collaboration with cryptography experts Nadia Heninger and Emmanuel Thomé.

Speed is the larger story

According to the research, AI agents can cut the time needed to probe the mathematical assumptions underlying encryption algorithms. Historically, uncovering vulnerabilities of this kind could take years of dedicated human effort. DeepMind's framing is that AI changes the tempo: humans still steer the research, but the models handle much of the exploratory work, testing ideas faster than a team of mathematicians could on their own.

The research arrives alongside other 2026 findings involving attacks on post-quantum candidates such as HAWK.

Who should pay attention

The immediate audience is anyone still running 1024-bit RSA. The research does not claim that current systems using stronger key sizes face any immediate risk. The findings target older, shorter keys specifically, not the current 2048-bit standard that secures most modern deployments.

Why this matters for IT, legal, and government professionals

Organizations in regulated industries - insurance, government, legal - often run legacy systems that may still rely on 1024-bit RSA for digital signatures or encrypted communications. Security and compliance teams should audit their cryptographic inventory for any remaining 1024-bit keys and prioritize migration. The research also signals that AI-assisted cryptanalysis is accelerating the pace at which older standards become obsolete, compressing the timeline for remediation planning.