AI agents just found cracks in old encryption. Check your business for 1024-bit RSA now

AI agents have just found a weakness in an old encryption standard that many businesses still have sitting in old devices and old software. On 6 November 2026, Google DeepMind presented two results: its AI agents, guided by human cryptographers, found two ways to attack old 1024-bit RSA encryption more easily than previously thought. The good news first: modern 2048-bit keys and larger are not affected by these results. The bad news: if you still run old systems, now is the time to check what you actually use.

What DeepMind found

The work was presented on 6 November by Pushmeet Kohli, DeepMind vice president of science, and described in two technical papers. It was led by DeepMind researchers Dj Dvijotham and Abhradeep Thakurta, together with cryptography experts Nadia Heninger and Emmanuel Thome. The agents worked in a sandbox and attacked a standard that is already retired, precisely because an attack there harms nobody.

The first result concerns forging digital signatures. Once an attacker controls about half of the signed block, the padding in the signature adds little protection. In the sandbox, the agents reproduced a forgery using 3.5 times less CPU time. For short inputs, for example a 32-byte fingerprint, DeepMind describes a new method that, on theoretical estimates, is about 1,600 times faster than the previous best method. The second result is a new algorithm for factoring many keys at once. It cuts the average cost of factoring each additional 1024-bit key by about 30 times. The numbers show one thing: old 1024-bit RSA is weaker than the textbooks assumed.

Why it matters to your business

1024-bit RSA has been considered outdated for years. The US standards body NIST has disallowed 1024-bit RSA for generating new signatures since 2013. Yet the old standard lives on: in old firmware, old devices, old certificates and software nobody has touched for years. Online banking, messaging apps, software updates and digital currencies are not threatened, because they almost universally use 2048-bit or larger keys. But a business running old devices, old servers or old IoT hardware can unknowingly sit on 1024-bit. That is no reason to panic, but it is a good reason for a check, while the attacks are still theory and not practice.

A practical checklist

1. Ask your IT provider or your IT team: where do we still use RSA with 1024 bits? Ask for a list of certificates, servers, VPN devices and old hardware.
2. Check certificates and firmware. Old web servers, old routers, old printers and old industrial equipment are the typical places to find it. Everything with 1024-bit keys belongs on the list for replacement.
3. Update what can be updated. Firmware updates, new certificates with at least 2048 bits, and replacing devices that no longer get updates are the three steps.
4. Ask your vendors. If a supplier gives you a portal, an app or a device, ask which key lengths are used and what the plan is for old systems.
5. Document the result. One page is enough: what was found, what was replaced, what is still open and who is responsible. The next time someone asks about security, you already have the answer.

What not to do

Do not replace everything at once in a panic. Start with the systems that are reachable from outside, and with certificates that expire soon. But do not ignore the topic because 2048-bit is safe either: only what you actually use is safe, not what you assume you use. And do not rely on an AI agent to solve the problem for you. The same technology that finds weaknesses can also be used by attackers.

The message from DeepMind is double: AI agents are becoming a tool of security research, and old cryptography is getting weak faster than many thought. If you know your systems and replace old keys, you have nothing to fear. Start with the question to your IT provider. It takes five minutes.

See our workflow automation service and our digital systems service.