The Machines Have Learned to Pick Locks: DeepMind’s AI Just Cracked Open the Vault of Old Encryption

What if the lock on your front door could be picked — not by a thief with a crowbar, but by a machine that had studied the lock, understood it better than its own maker, and then quietly, patiently, found the one weakness nobody else had noticed? Would you sleep soundly that night, telling yourself the lock on your neighbour’s door was different? Or would you understand, in that cold hour before dawn, that every lock ever made carries within it the seed of its own defeat — and that the only question is who finds the seed first?

On 6 November 2026, Google DeepMind announced that its AI agents, working under the supervision of human cryptographers, had found two new weaknesses in RSA encryption — the mathematics that guards the secrets of the modern world. The announcement was calm, technical, and carefully hedged. Do not be deceived by the calm. History has taught us that the most consequential sentences are often spoken in the quietest voice.

Bletchley Park Is Calling

To understand what happened last week, you must first walk the damp lawns of Bletchley Park in the winter of 1940. There, in a cluster of wooden huts in Buckinghamshire, a group of mathematicians, crossword enthusiasts and linguists — led by a shy, brilliant young man named Alan Turing — were fighting a war against a machine. The German Enigma machine could produce, as the records tell us, some 150 quintillion possible settings. The Germans believed it unbreakable. They were wrong, and their error was not in the mathematics but in the arrogance: they believed that a code which had never been broken could never be broken.

Turing’s Bombe machine did not break Enigma by being cleverer than the Germans. It broke Enigma by being tireless. It tested possibilities at a speed no human mind could match, discarding the impossible until only the possible remained. By the end of the war, roughly one in ten of all German Enigma communications was being read at Bletchley Park. The codebreakers shortened the war, and they did it by turning a human problem — guessing — into a machine problem: searching.

Now, eighty-six years later, the wheel has turned full circle. The machine is no longer the thing being broken. The machine is the thing doing the breaking.

The Lock That Guards the World

RSA is not a brand or a product. It is the invisible architecture of trust on which the digital world stands. Invented in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman at MIT, it rests on a beautifully simple idea: multiply two enormous prime numbers together, and the result is easy to produce but agonisingly hard to reverse. Your bank, your email, your government’s secrets, the software updates on your phone — all of them lean, in one way or another, on the assumption that factoring a sufficiently large number would take longer than the age of the universe.

That assumption has been chipped at before. In 1994, a team of 600 volunteers spent eight months factoring RSA-129, a 129-digit number that its inventors had once declared would take forty quadrillion years to break. The lesson of 1994 was not that RSA was dead. The lesson was that “impossible” is a word with an expiry date.

DeepMind’s announcement of 6 November is the latest chapter in that long story — and it is the first chapter written, in part, by an author that is not human.

What the Agents Actually Found

Let me be precise, because precision is a form of honesty, and this subject punishes exaggeration. DeepMind’s team — led by researchers Dj Dvijotham and Abhradeep Thakurta, working with the distinguished cryptographers Nadia Heninger of UC San Diego and Emmanuel Thomé of France’s Inria — reported two results, both aimed at 1024-bit RSA, a key size that standards bodies retired for new signatures years ago but that still lingers in old devices, mail systems, long-lived certificates and signed firmware across the world.

The first result concerns digital signatures — the mechanism by which your computer knows that a software update genuinely comes from its maker and not from an impostor. Before a message is signed, extra structured data called padding is wrapped around it, precisely to make forgery harder. The DeepMind agents found that once an attacker controls roughly half of the signed block, the padding buys almost nothing. Worse — and this is the number that travelled around the world — where the attacker controls only a short, 32-byte fingerprint of the data, the agents devised a new algorithm that DeepMind estimates is around 1,600 times faster than the best published method. In a sandboxed test against a 1024-bit benchmark key that academics had already broken earlier in the year, the agents’ implementation used three and a half times less computing time than the earlier work, and less than one-thousandth of the computing power that would be needed to factor the key itself. Note the honest caveat, which DeepMind itself states: the 1,600-fold figure is a theoretical estimate, not a full-scale measured run. The capability is real. The measurement is partial. Both facts matter.

The second result is about economics — and in cryptography, economics is destiny. In a working paper dated 5 November, titled “Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS”, the team showed how to factor many 1024-bit keys together, sharing one expensive precomputation across all of them. Each additional key, they estimate, could then be factored at roughly one fifty-eighth of the cost of factoring a single key — about thirty times cheaper than the best previous batch method. Again, this is a leading-order theoretical estimate; no implementation of the new method exists yet. But the direction of travel is unmistakable: breaking old keys is getting cheaper, and the discount grows with scale.

And here is the sentence that matters most, the one DeepMind repeated and the reporting has rightly carried: modern encryption is untouched. RSA-2048 and larger keys — the standard for everything that matters today — are not threatened by either result. Your bank account is safe. Your messages are safe. This was a demonstration in a sandbox against an obsolete key size, not a security emergency.

So why, then, should you care?

The Question History Always Asks

Because history does not repeat itself — but it does, as the old saying goes, rhyme. And the rhyme here is loud enough to wake the dead of Bletchley Park.

Consider what actually happened at DeepMind. The agents did not simply run faster. They did something that, until now, belonged exclusively to human intuition: they looked at a mathematical structure, found a crack in it that no human had seen, and then designed a new way through the crack. The slow, intuition-heavy part of cryptanalysis — the part that required a Turing or a Heninger to stare at a problem for months and then see, in a flash, what everyone else had missed — is now something a machine can take a real run at, under supervision, in weeks.

That is the true news. Not that 1024-bit RSA has two new weaknesses, though it does. Not that a theoretical number carries three zeroes, though it does. The true news is that the codebreaker has changed species.

Every lock in human history has followed the same arc. The locksmith builds. The lockpicker studies. The locksmith builds better. The Enigma was unbreakable until it was not. The 1024-bit key was safe until it was not. And the 2048-bit key, which stands guard over your life today, is safe — until the day it is not. The question is never whether the lock will fall. The question is whether we will have built the next lock before the old one falls, and whether we will have retired the old locks in time.

That is why the retirement of 1024-bit RSA matters, and why DeepMind’s careful insistence that “modern keys are unaffected” should be read as both reassurance and warning. The old keys are still out there — in hospital equipment, in industrial controllers, in government archives, in the forgotten corners of the internet where nobody has thought to look for a decade. A thirty-fold discount on breaking them is not a theoretical curiosity. It is a timetable.

The Moral of the Machine

And so I return to the question with which I began, because a column that does not ask its reader a question has failed its reader. Who do you trust with the keys to your life?

For fifty years we have trusted mathematics — silent, incorruptible mathematics — to keep our secrets. That trust was never misplaced. But mathematics is not a wall. It is a race. And for the first time in history, one of the runners in that race is not human. It does not tire. It does not sleep. It does not forget. It studies the lock the way Turing’s Bombe studied Enigma: tirelessly, until the impossible becomes merely difficult, and the difficult becomes merely a matter of time.

This is not a counsel of despair. The same intelligence that finds the cracks can also be set to seal them — the same agents, turned to defence, can hunt for weaknesses before the attackers do, and the post-quantum cryptography now being standardised around the world is being built precisely because wise people saw this day coming. The tools of the codebreaker and the tools of the locksmith have always been the same tools. What changes is who holds them, and to what end.

The men and women of Bletchley Park understood something we would do well to remember: a secret is only as strong as the humility of the people who keep it. The Germans lost their secret the day they stopped believing it could be lost. We will keep ours only so long as we never make the same mistake — only so long as we remember that every lock, no matter how clever, is a challenge issued to the future, and that the future has just learned to answer faster than we imagined.

The machines have learned to pick locks. The question, as ever, is what we will do with the knowledge — and how quickly we will do it.

Sources & References

• Aighten — “DeepMind AI Agents Find Two Weaknesses in 1024-bit RSA” (6 November 2026)
• DataStudios — “Google DeepMind AI agents find two weaknesses in legacy 1024-bit RSA”
• ShiftDelete — “DeepMind RSA-1024 Research Finds Attacks 1600 Times Faster”
• BYOBot AI Daily Newsstand — “DeepMind RSA Cryptanalysis” (8 November 2026)
• IACR ePrint Archive — “Forging 1024-bit RSA signatures in nearly SNFS time” (2026/2131, September 2026)
• Bletchley Park Trust — the Enigma machine and the Bombe
• Wikimedia Commons — Enigma machine photograph (U.S. Government work, public domain)