Google DeepMind published research on November 6, 2026 describing how human-guided AI agents accelerated cryptanalysis against legacy 1024-bit RSA settings. The work does not claim a break of modern 2048-bit deployments used in banking, messaging, or software update chains; instead it sharpens warnings about keys and signing interfaces that should have been retired years ago.
The first result revisits an unrestricted signing-oracle attack on a previously solved 1024-bit benchmark modulus. Two cooperating agents reproduced the computation in 391 CPU core-years versus 1,380 core-years reported earlier—an implementation gain within the same algorithm, not a fundamentally new attack. The sandbox assumed offline oracle access that live systems must forbid.
A second paper improves batch factoring heuristics for many moduli of equal size, lowering asymptotic cost per additional 1024-bit target. That finding is theoretical and unimplemented at scale, but it matters for organizations that still operate large fleets of legacy keys.
Researchers highlighted a padding insight: when attackers control roughly half of a signed block, padding offers little extra protection, collapsing toward unpadded difficulty. Even for shorter controlled regions such as thirty-two-byte fingerprints, agents estimated orders-of-magnitude improvements over prior methods in the 1024-bit setting.
Security engineers should treat the release as a mandate to finish inventories of weak keys, disable powerful signing APIs on edge devices, and accelerate migration timelines already recommended by NIST and industry baselines. Boards should ask for evidence, not assurances, on 1024-bit elimination.
Communications teams must resist sensational headlines. DeepMind explicitly separated legacy research from consumer encryption safety. Clarity prevents panic-driven certificate revocations that do not address actual exposure.
Cryptographers will debate peer review and independent replication. Until then, ops teams have a to-do list that does not require accepting every asymptotic claim: find weak keys, turn off dangerous interfaces, monitor for anomalous signing patterns.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Security procurement should treat dual-use model access like export-controlled tooling.
Immutable audit logs for authorized offensive research reduce insurance and regulatory friction.
Scope documents should list forbidden targets and escalation paths before models are enabled.
Further Reading
Discover more articles on similar topics across our network
Comments
Loading comments…