Google DeepMind just showed what happens when you point AI agents at cryptography. Working with expert cryptanalysts, its agents found two new weaknesses in legacy 1024-bit RSA in a matter of weeks, including a signature-forgery attack DeepMind estimates is roughly 1,600x better than the previous best in one setting.

Nothing modern is broken. 2048-bit keys are fine. But it lands the same week OpenAI showed GPT-6 Cyber building working exploits for 948 Linux bugs, and the pattern is getting hard to ignore: AI is making attacks on old systems cheaper, fast.

Also tonight: Google's new video model gets longer clips at a lower price, Thinking Machines ships its second-generation model, and four tools worth trying this weekend.

Google DeepMind's science team announced on Friday that AI agents, guided by human cryptanalysts, made two significant advances against legacy 1024-bit RSA in just weeks. DeepMind's Dj Dvijotham and Abhradeep Thakurta worked with Nadia Heninger of UC San Diego and Inria, and Emmanuel Thomé of Inria, per OfficeChai.

The first finding is about signatures. Once an attacker controls roughly half of the signed block, padding adds almost no protection. In a sandboxed test on an already-solved benchmark key, the agents reproduced a forgery using 3.5x less CPU time. When the attacker controls less, such as a 32-byte fingerprint, a new algorithm theoretically beats the previous best attack by about 1,600x for 1024-bit keys. The second finding is a batch-factoring algorithm that cuts the average cost of factoring each additional 1024-bit key by about 30x, Interesting Engineering reports.

Keep the scope straight. This is a research announcement, not a live breach: no affected production system was named, and modern RSA with 2048-bit or larger keys is untouched. The 1,600x number is a theoretical estimate, not a measured attack, and DeepMind hasn't published a paper link we could check, so treat the exact figures as the company's claims. What's real is the workflow: experts steering agents through months of cryptanalysis in weeks. That's the part every security team should notice.

1024-bit RSA was retired as a default years ago, but old keys rarely die on schedule. They linger in firmware signing, legacy VPNs, embedded devices and internal certificate chains nobody has touched in a decade. DeepMind's batch result is the one to sit with: if factoring each additional key gets about 30x cheaper, an attacker with a big pile of old public keys gets a volume discount.

The bigger shift is speed. Cryptographic strength used to erode slowly, on a schedule people could plan around. Agents that compress months of expert work into weeks change that math. The practical move this weekend is boring and worth it: inventory anything still using 1024-bit RSA and put it on a migration list for 2048-bit or larger keys. Treat "it's legacy, nobody will bother" as an assumption that just got more expensive to hold.

🎬 Google Ships Gemini Omni 1.2 Flash

Google's video model got longer and cheaper on Thursday. Gemini Omni 1.2 Flash generates and edits clips up to 15 seconds, up from 10 in Omni 1.1, in one-second steps from 3 to 15. Google cut pricing 30%, to $0.07 per second at 720p. It's generally available in the Gemini API, AI Studio and Google Cloud, and in Flow, Google Vids and Google Ads, with the Gemini app rolling out to AI Ultra subscribers.

The upgrade that matters most for real work is multi-turn editing: swap a product or background, change the lighting or flip the aspect ratio without regenerating the whole clip. It also takes character, product and style reference images, motion clips up to three seconds and audio cues, with better lip-sync and multi-speaker dialogue. You can draft at 360p or 720p and upscale to 1080p or 4K, and every output carries a SynthID watermark.

Our take: at list price, a full 15-second 720p clip costs about $1.05, cheap enough to iterate on ad variations and product shots instead of rationing generations. The catch is retries. Video models still stumble on fast action and tricky physics, so your real cost per usable clip depends on how many takes you burn. Want to try it free? Google Vids includes 15-second clips at no extra cost with a Google account.

Mira Murati's Thinking Machines Lab released its second model generation on Thursday. Inkling 2 Small is a mixture-of-experts model with 594B total parameters and about 17B active per token, image input, adjustable effort and up to a 1M-token context. It's live now on Thinking Machines' Tinker platform for sampling and fine-tuning, with closed weights for the moment.

The headline promise: full weights under Apache 2.0 "next week," once external safety testing and red-teaming wrap up. The company's own numbers include 72.1% on DeepSWE v1.1, 81.6% on MMMU Pro and a 30.6 on the Artificial Analysis Intelligence Index, all self-reported. It's also unusually candid about the gap: on its internal misbehavior score, Inkling 2 Small posts 14.9 versus 0.8 for OpenAI's GPT-6.1 Sol, where lower is better.

The training run is worth a look too. Thinking Machines says the main reinforcement-learning run took 9 days on 2,048 GPUs, with more than 17M rollouts, and that the model was trained natively in NVIDIA's 4-bit NVFP4 format on GB300 racks. That's a lab showing its receipts, which makes the open-weights promise more credible.

Our take: an Apache 2.0 model at this size from a well-funded US lab would be a real gift to builders who want to self-host. But "next week" is a plan, not a release. Prototype on Tinker now, and don't put Inkling on your roadmap as self-hostable until the checkpoint actually lands.

The other stories worth your attention this week:

METR says Anthropic is improving about 2x faster than its 2024-2025 pace on well-specified tasks (plausible range 1.3x to 3x), with roughly 80% of the speedup likely due to AI. Anthropic redacted much of the evidence METR found most informative. (METR)

Microsoft Research's PDD Kit uses the Verus verifier to prove agent-written Rust code matches a plain-language spec. In a 5,000-line demo app, verifying the login logic surfaced existing bugs. (Microsoft Research)

Box built agent search on Nvidia Nemotron, with Nvidia projecting 4x faster queries, 20% fewer errors and 90% fewer tokens. It reaches Enterprise Advance customers early next year. (TechCrunch)

Airbnb's AI travel agent arrives in the first half of 2027, building custom screens from hundreds of travel components and handling changes, refunds and rebooking after you book. (TechCrunch)

Baidu opened ERNIE 5.5 Flash Base, a 280B-parameter mixture-of-experts model with 14B active, on Hugging Face in FP8 and BF16. A post-trained version is expected to follow. (The Decoder)

Google DeepMind's AI agents, steered by expert cryptanalysts, found two new weaknesses in legacy 1024-bit RSA in weeks: a signature-forgery attack DeepMind estimates is about 1,600x better in one setting, and batch factoring that's about 30x cheaper per extra key. Modern 2048-bit keys are safe, but if anything you run still uses 1024-bit RSA, put it on a migration list now. Google's Gemini Omni 1.2 Flash stretches video clips to 15 seconds and cuts 720p pricing 30% to $0.07 a second. Thinking Machines' Inkling 2 Small is live on Tinker, with Apache 2.0 weights promised next week. One thread ties it together: AI is compressing expert work, whether that's cryptanalysis, video production or model training, and the people who adjust their assumptions first get the advantage.

Stay building. 🤖