On September 3, 2026, at 01:48 UTC, RSA-260 — a 260-digit composite number posted by RSA Labs in March 1991 as a factoring challenge — was split into two 130-digit primes whose product exactly reproduces the original number. FactorDB now lists it as FF (fully factored). The factoring effort was carried out by Eric Lu, a researcher at Cognition, working with a swarm of Devin, Cognition's flagship AI coding agents. Cognition published a methodology blog post on September 9, 2026, and the story drew renewed attention on Hacker News the same day.
First, the misconception to clear up: no quantum computer was involved, and there were no new algorithms. Ledger CTO Charles Guillemet put it bluntly: "No quantum computer was involved here." Eric Lu himself wrote that there were "essentially no algorithmic advancements." The workhorse was still the General Number Field Sieve (GNFS); the contribution was "good old performance engineering" — moving several bottleneck stages onto GPUs.
The case: RSA's security rests on easy multiplication, hard factoring
Multiplying two large primes takes a second; recovering those primes from the product is a problem of a different magnitude entirely. RSA encryption worldwide bets on this asymmetry, and GNFS is the fastest known classical method for factoring such numbers.
GNFS factoring is a four-leg relay:
1. Polynomial selection — 643 GPU-days; 1 winner picked from 83.55 million candidates. 2. Lattice sieving — 3,813 GPU-days, 7.9 days wall-clock; 13.85 billion raw relations. 3. Linear algebra — 467 GPU-days; a 656M × 656M sparse matrix with 98.4 billion non-zeros. 4. Square root — after Devin rewrote it three times (GMP → CPU Karatsuba → GPU NTT), factors emerged in 88 minutes on GPU.
Sieving consumed nearly 80% of total compute. Raw relations deduplicated to 8.3 billion. Total wall-clock time for RSA-260 was 15.6 days.
The methodology in one sentence: deeply modify CADO-NFS (the open-source INRIA implementation behind the RSA-240 and RSA-250 records), moving everything possible onto GPUs. The CPU lattice sieve las was replaced with a GPU version glas; the core challenge — pseudo-random access to large arrays on sieve lattices — is exactly what GPU memory bandwidth handles well. Linear algebra used a GPU block-Wiedemann implementation saturating NVLink and InfiniBand. Polynomial selection's first stage borrowed optimized msieve kernels.
Human and agent division of labor
At 00:11 PT on August 13, 2026, Eric Lu sent Devin its first instruction: build a drop-in GPU replacement for CADO-NFS's CPU lattice sieve. He went to sleep; when he woke up, Devin had iterated for another 7 hours on its own, and performance already exceeded the CPU version.
Over the next three weeks there were 233 Devin sessions (peaking at 18 concurrent, 101 of them sub-sessions Devin opened itself, 36 with zero human intervention). Eric sent 3,328 messages totaling 82,000 words and spent 14,450 ACUs. He described his own role as executive: setting goals, building benchmarks, catching and correcting drift. He humbly claimed his understanding of the components was comparable to "a mid-level car enthusiast," with little grasp of the underlying math.
Before attacking RSA-260, the team warmed up on smaller targets: C155, C157, C173, C175, C190, C201 — including two fully randomized control numbers. By the end, factoring a 190-digit number had been compressed from 11,443 seconds to just over 3 hours.
The numbers side by side
| Record | Time | Bits | Compute | Who did it | |---|---|---|---|---| | RSA-250 | Feb 2020 | 829 | ~2,700 CPU core-years | Boudot et al., 6 people | | RSA-260 | Sep 2026 | 862 | ~4,923 GPU-days ≈ 13.5 GPU-years ≈ $410K | Eric Lu + Devin |
From RSA-250 to RSA-260, the bit count rose by just 33, but difficulty increased roughly three times — per RSA-250 team member Thomé, "roughly three times." Notably, RSA-240 fell in November 2019 and RSA-250 in February 2020, then nobody moved for six years; this effort leapfrogged past 260 in one go.
One very practical cost-saving factor: the GPUs were idle fragments in Cognition's own training cluster — the scheduler's leftover capacity, unfit for the main training jobs. Lattice sieving splits naturally into 632,249 small tasks of about ten minutes each that can be preempted at any time. Idle shards of a large-model cluster turn out to be a perfect feed for the number field sieve.
A textbook-scale mix-up
Before the methodology was published, a rumor circulated that RSA-260 had been factored "by hand." Eric's colleague Sean joked that Eric had spent his 7 months at Cognition hand-computing random primes — effort beating talent. An aggregator account took it seriously. Scientific American's September 4 report half-relayed it, complete with an absurd "at least 7 months of computation" estimate. On September 9, Cognition's blog debunked it explicitly: contrary to the rumor, this was not done by hand-testing 130-digit primes, and Cognition has not built a multi-thousand-bit quantum computer. SciAm later added an editor's note. A news story about AI, and the first thing to break was the human rumor chain. Poetic.
Should you replace your RSA keys?
No. Eric did the math: factoring RSA-1024 would cost roughly $30 million at current prices — within reach of hyperscale cloud providers and frontier AI labs, though NIST has banned 1024-bit protection for new systems since 2013. This news just puts a price tag on an old warning. RSA-2048? Harder than RSA-1024 by a factor of roughly 91.2 billion; the blog states it "does not appear to be meaningfully affected by this work." The 2048-bit key in your wallet is still the same key.
On the quantum side: the largest integer Shor's algorithm has reliably factored on real quantum hardware remains 21. As in, 21 = 3 × 7. The classical factoring record just moved another notch; quantum is still standing in 2012.
Caveats, all on the table
There is no algorithmic novelty — the authors said so themselves. The real foundation is years of open-source accumulation in CADO-NFS; Lu even speculated that the codebase appears extensively in pretraining corpora, which helped the agents — his words: the further the code drifted from upstream CADO-NFS, the more confused the agents got. The siever and other implementations were not open-sourced as of September 10, so third parties cannot yet independently verify the 4,900-GPU-day efficiency claims. Also remember: Cognition is Devin's developer, and this blog post has an inherent product-demonstration motive. That said, the post discloses plenty of ugly details — polynomial selection burned 643 GPU-days, which the author self-deprecatingly attributes mostly to operator incompetence, and 7% of linear algebra compute was wasted to crashes and preemption. A blog willing to publish its ugly numbers earns a baseline of credibility.
One HN comment captured it well: this may be the first "I had an agent swarm do something" blog post that was actually written by a human.
Wrap-up
A cold case from 1991 was closed 35 years later by one human directing a team of agents. Cost: ~$410,000. Timeline: three weeks. The foundations of cryptography did not move — RSA-2048's math is accounted for. What moved is something else: a well-drilled agent cluster plus a person who knows what to watch can push pure engineering optimization very far. Three weeks ago, that question had no answer.
Sources
- Cognition methodology blog (Eric Lu, 2026-09-09): https://cognition.com/blog/factoring-rsa-260
- Scientific American (2026-09-04, editor's note added 09-09): https://www.scientificamerican.com/article/whats-the-tech-behind-the-record-breaking-rsa-260-crack/
- Senthorus security analysis (2026-09-06): https://blog.senthorus.ch/posts/rsa_260_factorization/
- lilting.ch technical breakdown (2026-09-04): https://lilting.ch/en/articles/rsa-260-factored-how-computed
- FactorDB entry (status FF): https://factordb.com/index.php?id=1100000000104374167
- RSA-250 record announcement: https://caramba.loria.fr/rsa250.txt