Engineer Leads Swarm of Devin AI Agents to Factor RSA-260 in 21 Days for ~$400K

Forum topic · 小凯 · 2026-09-12

Summary

Cognition researcher Eric Lu used the Devin AI coding agent to factor the 260-digit RSA challenge number RSA-260, completing the task on September 3, 2026 after roughly three weeks of work and about 4,923 GPU-days (~$400,000 at market rates) — a cost claimed to be one-tenth of the previous best public figure. The project built GPU-accelerated components on top of the open-source CADO-NFS implementation of the General Number Field Sieve, including a GPU lattice sieve (glas), polynomial selection, filtering, block Wiedemann linear algebra, and square-root stages. The result split RSA-260 into two 130-digit primes, the largest publicly solved number from the 1991 RSA Factoring Challenge, ending a six-and-a-half-year gap since RSA-250 in 2020. Lu reported no algorithmic advancements; the gain came from engineering execution. Lu acted as a non-expert supervisor, sending 3,328 messages across 233 sessions while Devin ran up to 18 concurrent sessions. Extrapolations suggest RSA-1024 could now cost around $30 million, while RSA-2048 remains practically unaffected.

21 Days, 260 Digits: One Engineer and a Swarm of Devin Agents Factor RSA-260

At 0:11 AM Pacific time on August 13, 2026, Cognition researcher Eric Lu gave Devin a single instruction: write a GPU-based lattice sieve, and keep iterating until it beat the CPU version. Twenty-one days later, on September 3, the 260-digit RSA-260 was split into two 130-digit primes. The previous public record was RSA-250 in February 2020 — a six-and-a-half-year gap. The total cost was roughly 4,900 GPU-days, about $400,000 at market prices. Cognition states this is one-tenth the cost of the previous best public approach.

The Number Itself

RSA-260 is:

22112825529529666435281085255026230927612089502470015394413748319128822941402001986512729726569746599085900330031400051170742204560859276357953757185954298838958709229238491006703034124620545784566413664540684214361293017694020846391065875914794251435144458199

It is the product of two 130-digit primes and the largest entry publicly solved from the RSA Factoring Challenge posted in 1991.

This does not mean RSA encryption is broken. Modern public keys are typically 2048-bit (~617 decimal digits); 1024-bit keys (~309 digits) were deprecated in 2013. What's more notable: the person who factored it is not a number theorist, and no new algorithm was used. As Lu wrote bluntly: "I report essentially no algorithmic advancements."

GNFS Is a Pipeline, Not a Formula

Large-integer factoring uses the General Number Field Sieve (GNFS) — a pipeline of five stages, each feeding the next:

1. Polynomial selection 2. Lattice sieving (relation finding) 3. Filtering / deduplication 4. Sparse linear algebra 5. Square root to extract factors

Cognition built on the open-source CADO-NFS, replacing components with GPU versions: a GPU first-stage polynomial selection (gps1), a GPU lattice sieve glas replacing the CPU las, rewritten coordination and filtering, GPU-oriented block Wiedemann linear algebra, and a GPU-accelerated square-root stage. glas was the centerpiece, designed as a "plug-and-play replacement" for CADO-NFS's sieving step.

How the Three Weeks Were Spent

The first prompt went out at 0:11 on August 13. Two hours later Lu added that the sieve must handle RSA-250-scale parameters, then went to sleep. Devin iterated for seven more hours and got it working.

Then came a scaling ladder: C155, C157, C173, C175, C190, C201, C311. On day one, a 157-digit number took 3h11m; by day five, a 190-digit number took 3h10m. Polynomial selection started August 18 at 12:14; the factors landed September 3 at 01:48 — a 15.6-day run, about three weeks including surrounding engineering.

Where the Money Went

| Stage | GPU-days | Notes | |---|---|---| | Polynomial selection | 643 | Lu self-assessed as "abnormally high, mostly operator incompetence" | | Lattice sieving | 3,813 | Most expensive; two glas upgrades yielded 14–17% gains | | Linear algebra | 467 | ~7% lost to crashes or preemption |

Total: 4,923 GPU-days (~13.5 GPU-years). At $3.5/GPU-hour, roughly $414,000.

Sieving produced 13.85 billion raw relations; after filtering, 8.299 billion unique relations (40.1% duplicates). The resulting matrix was 656,182,601 × 656,182,189 with 98.4 billion nonzeros — 150 per row.

What the Human Actually Did

Lu is not a cryptographer; he compared himself to a "mid-level car enthusiast" — understands how parts fit and what normal operation looks like, but not the underlying physics. Math consulting came from Alex Lombardi.

His side of the ledger: 233 sessions for the factorization, 14,450 ACUs; 3,328 messages, 82,702 words across 192 sessions. Devin opened 101 subagent sessions, 36 of which Lu never touched. Peak concurrency: 18 sessions; average 3.

Of his seven listed contributions, five were "executive functions": setting goal hierarchies, stopping wasted work ("you don't need that measurement"), pointing out repeated inefficiencies, suggesting unexplored directions ("make sure the GPU isn't blocked on the CPU," "can we use NVLink SHARP here"), and catching premature abandonments.

His self-described biggest contribution: pushing to establish a unified system of measurements, benchmarks, and performance estimators — things that "obviously don't form spontaneously." He also observed that the further the codebase drifted from upstream CADO-NFS, the more the agent struggled. Without CADO-NFS's stage structure, interfaces, and CPU reference implementation, he stressed, this would have been impossible.

Is Encryption Still Safe?

Cognition's extrapolation: RSA-1024 (309 digits) is only ~78× harder than RSA-260 under standard GNFS scaling — about $30 million per number at market rates, possibly half that with further optimization. That 1024-bit RSA is unsafe isn't news; it was deprecated in 2013.

RSA-2048 is roughly a billion times harder than RSA-1024. In Lu's words, these efficiency gains have "little impact on the feasibility of factoring RSA-2048-scale numbers with GNFS." This is closer to a cost event than a cryptographic one.

After the Barrier Drops

Lu's conclusion: the barrier to entry for cryptanalysis, computational math, and likely most large-scale scientific computing research is far lower than it used to be.

A key judgment: what was lowered is the "engineering execution" barrier, not the "problem definition" barrier. Lu's heaviest task was decomposing a vague goal into segments with stable interfaces and reference outputs — a decomposition inherited from CADO-NFS's twenty years of structure, not invented by the agent.

One accounting note: the project ran on Cognition's own cluster fragmentation — spare single nodes in NVL72 racks that are useless for training but ideal for preemptible, independent lattice-sieving tasks. The $400K market-rate figure is opportunity cost, not cash spent.

The question to watch isn't when RSA-1024 falls, but whether this path replicates. Any research problem that can be shaped into "reference implementation + measurable benchmarks + many independent subtasks" is a candidate for agent-swarm acceleration: molecular docking, lattice QCD, large-scale combinatorial search.

References

1. Cognition blog, "Factoring RSA-260," Eric Lu, 2026-09-09 — https://cognition.ai/blog/factoring-rsa-260 2. Senthorus Blog, "Inside the RSA-260 Factorization: GPU-Accelerated GNFS and the Role of Devin," Guillaume Dumas — https://blog.senthorus.ch/posts/rsa_260_factorization_cognition_explanation 3. AI Watch Station, "Cognition Says Devin Helped Factor RSA-260" — https://ai-watch-blog.vercel.app/en/posts/2026-09-09-devin-rsa-260-factoring 4. FreeAI, "How a Swarm of AI Agents Factored RSA-260 in Three Weeks for $400K" — http://freeai.help/blog/how-a-swarm-of-ai-agents-factored-rsa-260_en 5. FrontierNews, "How One Engineer and an AI Coding Agent Factored a 260-Digit Number" — https://www.frontiernews.ai/news/article/how-one-engineer-and-an-ai-coding-agent-factored-a-61ea84c8