Editorial Team
8 min read
AI agents reproduced an earlier 1024-bit RSA signature computation using less CPU work and a large cluster. Separate theoretical advances depend on signing access or costly shared preparation; the authors say modern RSA deployments are unaffected.
Google DeepMind, Google’s AI research unit, reports that AI agents cut the CPU work needed for a controlled computation underlying a legacy RSA signature attack by about 3.5-fold. The agents reused an established algorithm and an already-solved academic benchmark. Two working papers also propose mathematical advances whose larger claimed gains remain untested at cryptographic scale.
The completed experiment required billions of calls to a simulated signing service and a large computing cluster. It neither recovered a private key nor compromised a live system. The immediate significance is a more efficient implementation of known cryptanalysis, alongside new estimates of how much protection older systems provide.
Company-reported CPU costs for the same benchmark instance, charted by Magica from DeepMind’s working paper. The 391 core-years exclude GPU work and 7.5 core-years of probes and rehearsals. Source: Google DeepMind — Modular Roots working paper.
RSA relies on the difficulty of factoring a large number, called a modulus, into its prime factors. Signatures use related mathematics to let recipients verify authenticity.
In its signature working paper, the team reports computing a modular root—the mathematical operation underlying an RSA signature—using 391 CPU core-years, compared with about 1,380 in an earlier academic computation by Laura Shea and colleagues on the same 1024-bit instance. Both used the same algorithm, polynomials and parameter bounds. The roughly 3.5-fold improvement therefore measures implementation and execution efficiency.
The experiment depended on temporary access to a signing oracle, a service supplying roots of chosen inputs. Of the 391 CPU core-years, 318 went into preparation with oracle access and 73 into computing the target’s root after access ended. A core-year measures accumulated CPU time, however many cores run in parallel; the paper counts usage on virtual cores. Preparation is paid once for a given modulus, while computing another target’s root incurs the later phase’s cost again.
The researchers estimate that factoring the benchmark modulus outright would take 500,000 to 1 million core-years, citing the earlier study. That explains the appeal of an oracle-assisted attack, but compares measured CPU work with an estimated factoring cost and assumes access that standalone factoring does not need.
In the research announcement, DeepMind says researchers Krishnamurthy (Dj) Dvijotham and Abhradeep Thakurta led the work, collaborating with cryptographers Nadia Heninger, affiliated with UC San Diego and Inria, and Emmanuel Thomé of Inria. Heninger and Thomé also coauthored the earlier benchmark study. Thomé was an author of the 2007 oracle-assisted method, according to the signature paper’s references.
Coauthor Pushmeet Kohli, DeepMind’s vice president for science and strategic initiatives, announced the findings. He also helped develop AlphaEvolve, the lab’s earlier coding agent for discovering and optimizing algorithms by generating programs and automatically evaluating them.
The lab was formed in 2023 by combining DeepMind with the Brain team from Google Research. Its May 2025 AlphaEvolve announcement described work on computing efficiency and mathematical problems. The RSA papers continue that algorithm-research agenda, but the signature paper identifies its cooperating models only as Model A and Model B; it does not identify them as AlphaEvolve.
An account of the findings relays DeepMind’s argument that AI accelerates cryptanalysis. The papers provide evidence of what the agents accomplished on these tasks; they do not establish a general rate at which AI will erode cryptographic security.
Google DeepMind’s AlphaEvolve workflow, announced in May 2025. This illustrates earlier work; the RSA paper does not identify its agents as AlphaEvolve. Source: Google DeepMind — AlphaEvolve announcement.
The signature findings concern interfaces that let a caller choose inputs before a target to be forged is known. A separate oracle program held the benchmark’s factorization and answered 4,055,916,065 queries during preparation. After that access ended, the researchers generated the target and completed the computation without further queries, according to the paper.
The new mathematical result asks how much protection comes from padding, the fixed formatting added around caller-supplied data. For certain PKCS#11 interfaces—the standard through which applications use keys in cryptographic devices—the researchers show that sufficiently long caller-controlled data makes the restricted interface as useful as an unrestricted oracle, at twice as many queries.
At 1024 bits, the proven result covers caller-supplied data of at least 65 bytes in a 128-byte block. A 64-byte digest lies near the threshold: the paper supports that case with measurements, rather than the same unconditional proof. This is a finding about particular input formats and access rights, not a claim that all RSA padding fails.
A 32-byte digest leaves a harder problem. The researchers propose a faster algorithm for that regime; Kohli’s announcement describes a roughly 1,600-fold improvement for 1024-bit keys based on theoretical estimates. The paper says this algorithm has not been run at cryptographic size and its cost analysis relies on unproven heuristics of the kind used in number field sieve analyses. Interfaces that hash messages inside the device fall outside both oracle models because callers cannot directly choose the resulting digest.
Two cooperating language-model agents designed, implemented, ran and debugged the completed computation, the authors report. A human researcher chose the problem, oracle bound and instance and sent about 20 messages, mostly approvals. The agents added about 33,500 lines of code on top of an existing pipeline for smaller moduli and managed 336 distributed experiments. A specialist sub-agent assisted with one linear-algebra task.
The run finished in 3.2 days from the first full-scale sieving job, compared with about five months for the earlier study. That calendar comparison mainly reflects parallelism: the new experiment averaged about 45,000 busy CPU cores, against about 3,300 previously, and peaked at about 300,000 cores plus 16 GPUs. It is separate from the reduction in CPU work.
Even the CPU comparison needs qualification. The 391 core-years exclude GPU work—about 330 GPU-hours reserved—and 7.5 core-years of probes and rehearsals. Charging the GPU stage at the earlier study's CPU cost and adding those trials reduces the reported improvement to about 3.3-fold. Same-machine tests of the sieving code nevertheless support a substantial software efficiency gain.
The paper also records an initially incorrect root caused by a 32-bit index overflow. The agents diagnosed and fixed it, and the final root was independently checked against the public mathematical relation. Automated checking was essential to the result's credibility.
The second working paper, dated November 5, 2026, combines two established ideas: sharing preparatory work across many integers of the same bit length, and giving each target several algebraic number fields to search. The targets need not share prime factors; sharing a standard key size is enough for the model.
The central improvement applies when an attacker can first spend roughly the cost of one general number field sieve factorization. After that investment, the authors' leading-order estimate puts each additional 1024-bit target at about one fifty-eighth of a standalone general-sieve run, or about 30 times cheaper than the previous multiple-number-field method at the same preparation budget. That comparison method dates to 1993, according to the paper.
The authors say AI agents developed the analysis and its Lean 4 formalization. Machine checking verifies algebraic identities and feasibility witnesses; the runtime claims still depend on unproven heuristics standard in number field sieve analyses.
Those ratios omit mathematical terms whose practical effect is unknown. They are not measured runtimes. No fan factory has been implemented, and the method offers no improvement for an isolated integer without shared work. With unlimited preparation, the older factorization factory remains optimal within the analysis. For batches processed together without advance preparation, the estimated gain at 1024 bits is at most 1.75-fold, rather than 30-fold.
Storage is another barrier. At the preparation budget used for the headline comparison, the paper's leading-order estimate calls for a table containing about 2^75 pairs at 1024 bits. Batch mode avoids storing that table, but its hardware area–time trade-off remains unresolved. The ability to amortize arithmetic therefore does not establish an affordable attack infrastructure.
NIST’s March 2019 guidance disallowed RSA signature generation below 2048 bits and classified verification from 1024 to below 2048 bits as legacy use. Source: NIST — SP 800-131A Revision 2.
The authors explicitly say both papers leave deployed RSA systems using keys of 2048 bits or more unthreatened by these results. The legacy distinction predates this research: the US National Institute of Standards and Technology, which develops security standards and guidance for federal information systems, required RSA moduli of at least 2048 bits for federal signature generation in its March 2019 guidance. It allowed verification with 1024-bit to below-2048-bit RSA as legacy use: processing information already protected, with accepted risk. Nongovernmental organizations could follow the guidance voluntarily.
For legacy signing devices, the relevant questions are what inputs callers can choose and how much direct signing access they have. For the new algorithms, the missing evidence is an implementation at cryptographic scale with measured compute, memory and storage costs, compared with a well-tuned existing method. Those tests would establish whether the theoretical savings translate into practical attacks and at what resource budget.
Anthropic plans IPO marketing next week and a listing in the week of November 16, according to people familiar with the plans. Buyers are discussing valuations of $1.2 trillion–$1.3 trillion, with some weighing $1.1 trillion, as its filing reveals faster-growing compute costs and extensive infrastructure commitments.
India's IT lobby chief warns that AI could make technology jobs harder for graduates to secure. Hiring is below earlier peaks, but some firms favour AI-equipped beginners over costly experienced staff. The unresolved question is how junior workers will build expertise.
Internet scans and leaked databases expose the spread of ARTEX, a security-testing framework used in cyberattacks. Researchers documented largely autonomous compromises, but the records also show failed cashouts and uncertain counts of independent deployments.
Meta's strategy chief and former CFO is joining Fireworks AI ahead of a reported fundraising push targeting at least a $30 billion valuation. The inference company announced a $17.5 billion valuation in July, making the hire part of a much larger expansion than its older funding figures suggest.
Sand.ai says its $200 million Series A+ round lifts its valuation above $1 billion. Co-lead investor Wangsu plans inference and deployment cooperation, while its filing shows substantial losses behind the startup’s video AI ambitions.
An advocacy group estimates Interior Secretary Doug Burgum’s AI holdings at $18.1 million–$64.4 million as his department advances data centers on public land. His ethics agreement allows retained investments with recusals, while pending permits will determine both the application of those safeguards and the public’s return. Interior denies his decisions are driven by personal investments.
Microsoft is evaluating fewer neocloud partners while expanding its own infrastructure. Delivery-dependent contracts underpin supplier financing, while IREN reports rising revenue alongside a $6 billion funding target for its broader expansion.
Physical Superintelligence says its AI system found a proof of a conjecture limiting quantum query advantages on random inputs. Public proof files enable scrutiny, but do not establish the private system’s cost or repeatability.
OpenAI is expanding its relationship with Hacktron, whose researchers previously reported an attack chain into employee accounts, to test third-party connections with greater access to cybersecurity models.
Google has acquired Crusoe’s southeast Wyoming data center site, where it plans a long-term $17 billion investment. Crusoe describes completed pre-development work; independent reporting points to customer setbacks. Power delivery and carbon capture remain key tests.
The team behind document-parsing service SoMark has released OXR-1.0 code and weights. A benchmark retest supports a strong result, but speed and accuracy were measured separately, and users above funding or revenue thresholds need a commercial license.
OpenAI is reportedly developing a Business Hub with daily mention and click charts, product updates and business agents. The unannounced feature could give verified businesses direct visibility into ChatGPT responses, without revealing prompts or competitor rankings.
Palantir and Nvidia have specified an integrated stack for running AI in customer-controlled environments. The architecture builds on existing software and infrastructure offerings, with published configurations spanning 32 to 640 GPUs, while pricing and workload economics remain unproven in the launch materials.
Democrats’ incoming congressional majorities put hearings and investigations within reach, but AI rules and crypto legislation still face bipartisan bargaining and a Republican president.
Microsoft reportedly declined to renew Oracle server rentals as older chips became less useful to it. The decision comes despite continuing capacity shortages, while Oracle says demand for earlier-generation GPUs remains strong.
An investigation puts Nvidia’s future commitments and guarantees at $530.5 billion. Its disclosures show rapidly expanding supplier commitments and phased support for customers whose infrastructure could generate further chip sales, with cash payments depending on timing, demand and contract terms.
TSMC is reportedly planning a possible move into 3D DRAM at Nvidia’s request. The foundry already helps integrate AI processors with memory, but a manufacturing expansion has no disclosed factory or production date.
Physicl has raised a $10 million seed round and introduced Studio, a beta app for generating targeted physical AI data. Its reported customer gains concern 3D reconstruction, leaving broader robot reliability and commercial economics to be demonstrated.
New cloud partners in Southeast Asia must enroll in Nvidia’s Fleet Intelligence system, according to a report, linking preferred chip access to monitoring while leaving data sharing and existing partners’ obligations unresolved.
Airbnb sold intellectual property to a private AI lab controlled by CEO Brian Chesky in a $7.1 million arrangement that also reimburses expenses. It obtained a license to certain lab technology and future investment rights, but disclosed no asset valuation or detailed license terms.