Beyond the headline 3.5× cost cut on the 1024-bit signature forgery, the operational details of the agent run are what stand out.

According to mlq.ai, a supervisor agent wrote the design and audited results while an executor agent wrote roughly 33,500 lines of code and ran jobs on up to 300,000 CPU cores.

The human researcher — working with cryptographers Nadia Heninger and Emmanuel Thomé — sent about twenty short messages, mostly approvals.

The first forged root took 391 CPU core-years versus 1,380 in the original study, and the run finished in 3.2 days from the first full-scale sieving job, against about five months previously.

The surprise is that the gain came without a new algorithm.

mlq.ai reports the 3.5-fold reduction is attributed to better code and execution on the same key with the same algorithm and parameters — a demonstration that AI agents can squeeze large factors out of well-studied computational workloads through engineering alone.

SecurityWeek notes the agents designed, ran and debugged the forgery in under four days in a sandboxed test, and that the key itself was not factored, which would still take an estimated 500,000 to 1 million core-years.

The bulk-factoring result is purely theoretical: the method, roughly 30 times cheaper per additional key than Coppersmith's multiple number field sieve, has not been implemented.

The second paper's key algebraic identities were machine-checked in the Lean 4 proof assistant, with one AI model generating the proofs and a second verifying them — according to mlq.ai, a notable pipeline for AI-produced mathematics.

The papers' padding theory shows padding stops protecting a 1024-bit key once the attacker controls about half the signed block, including a 64-byte digest such as SHA-512; with a 32-byte digest like SHA-256 the theoretical cost exponent drops from 1.8171 to 1.5803, an estimated 1,600 times better than the prior method.

SecurityWeek reports the signature attack requires roughly 4 billion signing queries in advance, does not recover the private key, and fails against devices that hash messages internally.

Both papers state their results do not threaten deployed systems based on 2048-bit or larger RSA, which modern protocols use.

The exposure is concentrated in legacy 1024-bit keys still signing on older hardware and embedded devices, often through PKCS#11 interfaces on hardware security modules — those now have less margin than assumed.

DeepMind VP Pushmeet Kohli told SecurityWeek that "we cannot treat cryptographic hardness as a fixed assumption," arguing AI should be used to rigorously test long-held assumptions to keep modern encryption secure.