Sandboxed reproduction of a 1024-bit RSA computation
Google DeepMind reports that two AI agents carried out a known 1024-bit cryptography computation over nearly four days, using about 20 human messages, mostly approvals. The test involved RSA digital signatures, and the agents did not recover a private key. The work reproduced a previously solved benchmark instance in a sandbox. A DeepMind researcher announced the work on Nov. 6. According to the paper, the results do not threaten deployed cryptosystems based on 2048-bit or larger RSA.
Agent roles and output
A supervisor agent maintained design, budgets and checks. An executor wrote and tested code, launched distributed jobs, and fixed failures. A specialist sub-agent helped speed one linear-algebra step. The agents produced about 33,500 new lines of code, ran 336 distributed experiments, and exchanged 218 messages. From design to verified result, the work took three days and 22 hours.
Errors and human involvement
Their first computed root was wrong because a 32-bit offset overflowed. A correctness check caught it. The agents found and fixed the error without repeating the advance signing queries. The human chose the problem, the instance, and limits on the signing service, and also approved conditions for irreversible steps. According to the paper, the researcher wrote no code, launched no jobs, and diagnosed no faults. The task was still human-selected with approval gates.
CPU savings and comparison caveats
The working paper reports 391 CPU core-years for the completed computation. An earlier team reported a rounded 1,380 on the same instance and algorithm, which is about a 3.5-fold reduction in measured CPU use. GPU work and preliminary probes are excluded. The earlier academic computation took about five months. DeepMind’s run took 3.2 days from its first full-scale sieving job to the verified root, reaching about 300,000 CPU cores and 16 GPUs at peak. The authors attribute the calendar-time difference mainly to parallelism. The CPU totals came from different hardware, so this is not a controlled like-for-like comparison.
Cryptographic setup
A separate program holding the modulus factorization answered roughly 4 billion advance queries. It was withdrawn before the target was drawn. The agents then computed the target’s root without further queries.
Limits on the claim
The measured reproduction did not demonstrate the paper’s new algorithm for more restricted signing access at cryptographic size. A separate Fan Factories paper estimates roughly 30-fold lower costs per additional 1024-bit target than the multiple number field sieve, after shared precomputation costing about one general number field sieve factorization. Those are leading-order heuristic estimates, and no fan factory has been implemented. The working paper names the main models only as A and B and links no public implementation repository, which limits outside comparisons.
