DeepMind AI agents weaken 1024-bit RSA: check your keys

AI agents just made old encryption a little weaker. On November 6, Google DeepMind said its AI agents, working under human supervision, found two new weaknesses in legacy 1024-bit RSA, Interesting Engineering reported. Modern 2048-bit keys aren't touched. But if anything in your business still signs with a 1024-bit key, this is the push to rotate it.

What actually happened

The work was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta with researchers from UC San Diego and France's Inria, and was announced by DeepMind's Pushmeet Kohli on X. The reported results:

• Signature forgery. Even when an attacker controls only a small part of the signed data, such as a 32-byte digest, the agents found an algorithm that theoretically improves on the best prior attack on 1024-bit RSA by about 1,600x. That is an estimate, not a demonstrated break.
• Batch factoring. A second algorithm cuts the average cost of factoring each additional 1024-bit key by about 30x versus earlier batch methods. Factor one key, and the next ones get cheaper.
• A real run. In a sandbox, the agents reproduced an earlier academic 1024-bit result using 3.5x less CPU time.

The reported scope is narrow: 1024-bit RSA, which was largely replaced by 2048-bit and larger keys years ago. Interesting Engineering notes the findings don't threaten the encryption behind online banking, messaging apps or software updates.

We couldn't read DeepMind's full papers before publishing, so we've kept to the figures reported above and left out finer details.

Why the 1024-bit RSA news matters for your business

Nobody is forging your signatures tomorrow. The point is the direction: AI agents now help people find shortcuts in cryptography faster. Every margin on old keys gets thinner, not thicker.

1024-bit keys hide in boring places:

1. DKIM email signing. The DKIM standard, RFC 8301, sets 1024 bits as the floor and says signers should use 2048. Plenty of domains set up years ago never moved. Look up your DKIM record in your email provider's admin panel, and if the key is 1024-bit, generate a 2048-bit one and rotate.
2. Old network gear. Aging routers, VPN appliances and printers with admin pages often ship weak keys and never get new ones.
3. Legacy SSH keys. Check for old RSA keys on servers and in deploy pipelines. Replace them with Ed25519 or RSA 2048+.

Sources: Interesting Engineering, Pushmeet Kohli on X, RFC 8301.