What happened
Google DeepMind’s November 5, 2026 working paper, *Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS*, studies how to factor many integers of the same size by reusing work. Its subject is the number field sieve (NFS), whose heuristic running time is expressed using an exponent constant: a lower constant means lower asymptotic cost. The paper compares established approaches, including the general NFS (GNFS), multiple number field sieve (MNFS), Coppersmith’s factorization factory and batch NFS.
The proposed factory precomputes a shared rational side once, then gives each target integer its own fan of algebraic polynomials. Pairs that meet a smoothness condition on the shared side can be tested against the fields in that target’s fan. The authors analyze the smallest per-target exponent across precomputation budgets. Their theorem says that for budget exponents between the MNFS constant, about 1.9019, and a transition near 1.9496, the fan factory improves on prior methods. At the transition, the optimal fan shrinks to one polynomial; at larger budgets, one polynomial per target is optimal. With a budget of one GNFS run, the paper gives a per-target exponent of about 1.7929, compared with about 1.9019 for MNFS.
The paper also analyzes batch factoring without precomputation. For a batch of L[μ] same-size integers, it reports an improvement over MNFS and single-polynomial batch NFS when μ is below 0.2785; above that threshold, one polynomial per integer is optimal. The maximum numerical gain in the per-integer exponent is 0.0180, at μ about 0.0213. These are comparisons of asymptotic exponent constants, not benchmark timings.
For a concrete illustration, the authors set lower-order terms to zero. At that leading order, a one-GNFS-run precomputation for 1024-bit integers makes each further integer cost about 1/58 of a GNFS run and 30 times less than MNFS. Counting precomputation, they estimate that three or more integers already cost less through this method than through MNFS. The paper says the exact running-time factors hidden in the asymptotic terms are not determined by its analysis. It also says the results do not threaten deployed cryptosystems based on 2048-bit and larger RSA. The authors report that the work used a two-agent AI harness: one model generated proofs and a second verified them. Algebraic identities and exact feasibility witnesses are machine-checked in Lean 4.
What the archive adds
New Runtime’s earlier coverage reported that four Gemini 4 Argon agents defeated Minecraft’s Ender Dragon in a fresh survival world (October 24, 2026 note). That was a different task and result; this paper adds a cryptographic algorithm analysis and a described proof-generation and verification workflow. It is a new event, not a restatement.
Trend signal
This supports the shift toward harness architecture as a durable boundary for agent work: the paper describes distinct generation and verification roles, while the mathematical result is checked in Lean 4. The connection is limited: the paper does not establish that the agent harness itself caused the algorithmic improvement. See Harness architecture outlives model choice.
Why now
The paper is dated November 5, 2026. Its authors frame the significance not as an immediate threat to current RSA deployments, but as evidence about how quickly AI-assisted research may advance a field that usually moves slowly.
Why it matters
For security teams, the headline distinction is between a theoretical improvement for factoring 1024-bit integers and a demonstrated attack against deployed systems. The paper explicitly says it does not threaten RSA systems using 2048-bit or larger keys. Its estimates are asymptotic, rely on standard NFS heuristics and are not measured runtimes; they should not be treated as a practical break or as a reason to infer a timetable for larger-key attacks.
For AI builders, the paper offers a concrete example of a workflow in which generation and verification are separated, with Lean 4 checking algebraic identities and feasibility witnesses. That is a useful reminder that research claims become more inspectable when outputs connect to formal artifacts. It does not, by itself, demonstrate that the models independently established the result or that the method is ready to run as software.
Limits and uncertainty
The cost claims rely on standard heuristics used in NFS analyses and compare asymptotic exponent constants. The paper says the lower-order terms hidden in those estimates are not determined, so the 1024-bit ratios are leading-order illustrations rather than predicted runtimes. The reported Lean checks cover algebraic identities and exact feasibility witnesses; they do not constitute an independent reproduction of every heuristic complexity claim. The paper’s stated scope excludes a threat to deployed RSA at 2048 bits and above.
Reader takeaway
The paper lowers theoretical factoring costs for certain batches of same-size integers, especially with limited shared preprocessing. Its 1024-bit ratios are asymptotic illustrations, not operational measurements, and its authors explicitly distinguish the result from a threat to deployed 2048-bit-and-larger RSA. The notable AI-workflow detail is a generation-and-verification harness paired with machine-checked mathematics.
Open question
How much of the leading-order advantage survives in a complete implementation and measured runs?