Google says its AI agents made attacks on old encryption keys cheaper, doing months of work in four days

Google DeepMind said on Friday that its AI agents, working under human supervision, found two new ways to make attacks on an older form of encryption cheaper. The target is 1024-bit RSA, a key length that U.S. standards no longer accept for new digital signatures. DeepMind and its co-authors say modern 2048-bit keys, which protect most banking, messaging and software updates, are not affected.

The business story is less about the math than about speed and labor. By DeepMind's account, two AI agents wrote about 33,500 lines of new code and ran a full-scale 1024-bit computation in under four days. The human researcher sent about 20 messages, mostly approvals, and wrote no code. A university team needed about five months for the comparable computation it published in September, a gap the paper attributes mainly to running more jobs in parallel.

For companies, the message is that the cost of attacking old encryption is falling quickly. Keys that were "retired" on paper but never replaced are turning from a curiosity into a liability.

What DeepMind says it found

The first result concerns digital signatures, which prove that a document or software update came from who it claims. RSA signatures add filler data, called padding, to block forgeries. DeepMind's working paper says that once an attacker controls more than about half of the signed data, the padding no longer makes this attack any harder at 1024 bits.

To test this, the agents rebuilt a known forgery attack on a 1024-bit key that researchers at UC San Diego and France's Inria had attacked earlier. Their effort took 1,380 CPU core-years, a standard measure of computing time. DeepMind's run took 391, about 3.5 times less. The paper credits most of that saving to faster software, not new math, and says differences in hardware may explain only a small part of it.

DeepMind's announcement also cites a roughly 1,600-fold theoretical improvement for a harder case, where an attacker controls only a short 32-byte digital fingerprint. That is a theoretical estimate. The paper says the method was not run at that size.

The second result is about breaking many keys at once. After an upfront cost roughly equal to cracking one key, each additional 1024-bit key would cost about one fifty-eighth of a normal attack. On paper, that is around 30 times cheaper than the best previous method, which dates to 1993. Here the paper is blunt: nobody has built it yet. One AI agent wrote the proofs, a second checked them, and formal proof-checking software verified the algebra.

Who should care

The signature attack is not a remote break-in. It needs direct access to a signing system and billions of requests, about 4 billion in DeepMind's run. The most relevant systems are hardware security modules, the locked-down devices companies use to hold signing keys; the UC San Diego and Inria team used one as the signing system in its own test. The risk arises when such a device lets outside callers choose much of what gets signed. Devices that compute the fingerprint internally fall outside the attack, the paper says.

In theory, 1024-bit RSA should be rare by now. Certificate authorities stopped issuing 1024-bit web certificates around 2014. But older keys linger in embedded devices, long-lived internal company certificates, aging network gear and email. DKIM, the standard that lets inboxes verify which domain sent a message, still permits 1024-bit keys. Whether any email system exposes the kind of signing access the attack needs is unclear.

The batch result matters most to anyone holding large fleets of old keys, such as device makers or firms with legacy smart cards. If each extra key gets much cheaper to break, an attacker with a long target list gains the most.

A fast-moving pattern, with caveats

DeepMind's work lands seven weeks after two related results. On September 19, Anthropic staffer Stephen Weis said Claude helped factor RSA-896, a public 896-bit challenge number. Claude adapted open-source factoring software to run on up to 2,048 graphics chips for about 10 days. Weis claimed no new math but said 1024-bit keys are now within reach of organizations with large chip fleets. PostQuantum's Marin Ivezic estimated that cost at roughly $28 million.

The UC San Diego and Inria forgery paper followed a day later. In October, security researcher David Adrian predicted AI would mainly deliver gains through better code, enough to make breaking 1024-bit RSA practical, possibly by 2029. DeepMind's measured result fits that view: the 3.5-fold saving was engineering, while the larger numbers remain theoretical.

Several caveats apply. Both DeepMind documents are working papers, not peer-reviewed. As of Saturday, no outside group had reported reproducing either result. DeepMind has not named the AI models it used. And the two best-known outside cryptographers involved, Nadia Heninger and Emmanuel Thomé, are co-authors rather than independent reviewers.

For buyers, the action is not new: find remaining 1024-bit keys and replace them. What changed is the cost of waiting. Pushmeet Kohli, DeepMind's vice president of science, said the results show why "we must not assume the mathematical 'hardness'" of encryption schemes will last.

For investors tracking the AI labs, the more telling signal is labor. A two-agent system wrote and ran a months-long specialist project in days, with a human mostly approving its steps. That is the kind of productivity claim labs are now racing to prove, and it deserves the same outside checking as any benchmark.