AI finds weaknesses under human guidance

Google DeepMind on Nov. 6 (Nov. 7 Japan time) released research on X showing that AI agents can accelerate testing the strength of encryption. Under human guidance, the company's model found two major weaknesses in legacy 1024-bit RSA, it said. RSA is an encryption scheme whose security rests on the difficulty of factoring large numbers into primes, and it has been widely used for digital signatures and protecting communications. DeepMind said the current 2048-bit scheme is not affected by these weaknesses.

We're sharing new research demonstrating how AI agents can accelerate the science of stress-testing encryption.

@GoogleDeepMind · November 7, 2026

The research was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta, with cooperation from cryptography researchers Nadia Heninger (University of California, San Diego, and France's Inria) and Emmanuel Thomé (Inria), OfficeChai and Crypto Briefing reported. HuggingNews reported that the results were obtained in a few weeks. Which AI model was used could not be confirmed.

Signature forgery about 1,600 times by theoretical estimate, batch key factoring about one-thirtieth

The first weakness concerns forging digital signatures. According to OfficeChai, under conditions where an attacker can determine roughly half or more of the content being signed, the mechanism protecting the signature becomes almost ineffective. In a simulation using an already-solved 1024-bit benchmark key, the CPU time required was cut by a factor of 3.5. When the portion the attacker can determine is a short 32 bytes, the improvement is about 1,600 times over the previous best method, it said. This figure of about 1,600 times is a theoretical estimate, not a number measured by actually running the attack.

The second is a new algorithm that factors many keys together. The average cost per additional key is reported to fall to about one-thirtieth of previous batch processing. It is not described as lowering the cost of breaking a single key. Reports differ on the conditions for applying it, with TechFlow reporting keys of the same length and Crypto Briefing keys that are related to one another.

For both figures, the baseline costs being compared could not be confirmed. No statement that keys in actual use were broken could be confirmed either.

2048-bit unaffected, 1024-bit already legacy

DeepMind says the current 2048-bit scheme is not affected by these weaknesses. According to TechFlow, the impact is limited to deprecated 1024-bit keys, and the security of current systems using keys of 2048 bits or more is maintained. RuntimeWire pointed out that for operators, finding legacy keys remaining in production environments becomes important.

This explanation, however, is limited to the weaknesses found this time. A separate paper published in September by Heninger, Thomé and others concluded that under conditions where a signing device can be made to perform raw RSA operations, the effective security of 1024 to 4096 bits is 15 to 30 bits lower than estimates based on factoring. That research required about 1,380 CPU core-years to forge a 1024-bit signature, and is a separate result from this research.

The transition away from RSA itself is proceeding separately. The U.S. National Institute of Standards and Technology (NIST) on Oct. 27 published the final version of "IR 8547," its document on the transition to post-quantum cryptography. According to PostQuantum, RSA-2048 will be deprecated after 2030 and disallowed after 2035.

Cryptography research using AI comes one after another

Efforts to use AI to test cryptography have continued at various companies in 2026. Anthropic announced on July 28 that "Claude Mythos Preview" had found an attack that cut the effective strength of keys for "HAWK," a post-quantum signature candidate, by about half. It said discovery and verification took about 60 hours and about $100,000 in API costs, and that there was no impact on systems in actual use. According to The Hacker News, HAWK's development team withdrew it from NIST's call for proposals.

Records for RSA factoring also kept being broken. Eric Lu of U.S.-based Cognition announced on Sept. 3 that he had factored the 862-bit RSA-260 using the AI agent "Devin." He estimated the cost at about $400,000 at market prices, and estimated RSA-1024 at about $30 million. According to Startup Fortune, Anthropic's Stephen A. Weis factored the 896-bit RSA-896 using Claude on Sept. 19.

DeepMind argued that, given this research, conventional assumptions about computational difficulty can no longer be relied upon, and that cryptographic standards need continuous testing. OfficeChai reported that the aim of the research is to give defenders a means of measuring the strength of encryption in advance.

Main developments involving AI and cryptography in 2026. Compiled by ORIENS from various sources
  1. Anthropic announces discovery of a weakness in HAWKOfficial
  2. Cognition's Lu announces factoring RSA-260 with DevinReport
  3. Anthropic's Weis factors RSA-896 with ClaudeReport
  4. UC San Diego and Inria researchers publish paper on forging 1024-bit signaturesOfficial
  5. NIST publishes final version of IR 8547Official
  6. DeepMind announces two weaknesses in 1024-bit RSAOfficial

Underlying documents and third-party verification unconfirmed

As of Nov. 7, no URL for an official DeepMind blog post or paper could be found. Many of the figures are based on media reports of text by Pushmeet Kohli (vice president at DeepMind). No comments by outside cryptography researchers assessing the results could be confirmed either. Confirmation of the underlying documents and verification by outside researchers will be the focus.