On August 13, 2026 at 0:11 AM Pacific time, Cognition researcher Eric Lu gave Devin a single instruction: write a GPU-based lattice sieve and iterate until it beats the CPU version. Twenty-one days later, on September 3, the 260-digit RSA-260 was split into two 130-digit primes. The previous public record was RSA-250 in February 2020—a gap of six and a half years. The total cost was roughly 4,900 GPU-days, about $400,000 at market prices, and Cognition claims this is one-tenth the cost of the previous best public approach.
The number
RSA-260 is:
22112825529529666435281085255026230927612089502470015394413748319128822941402001986512729726569746599085900330031400051170742204560859276357953757185954298838958709229238491006703034124620545784566413664540684214361293017694020846391065875914794251435144458199
It is the largest entry publicly solved from the 1991 RSA factoring challenge. This does not break RSA encryption: modern keys are 2048-bit (617 decimal digits), and 1024-bit keys were deprecated in 2013. Notably, the people who factored it are not number theorists, and no new algorithm was used. As Lu wrote: "I report essentially no algorithmic advancements."
GNFS is a pipeline, not a formula
Large-integer factoring uses the General Number Field Sieve (GNFS): polynomial selection → lattice sieving (relation finding) → filtering/dedup → sparse linear algebra → square root for factors. Each stage feeds the next; stages are largely independent, which became key to the project.
Cognition used the open-source CADO-NFS as a base and GPU-accelerated it: a GPU polynomial selection stage (gps1), a GPU lattice sieve glas replacing the CPU las, rewritten coordination and dedup filtering, a GPU-oriented block Wiedemann linear algebra implementation, and a GPU-accelerated square root stage. glas was the centerpiece—a "drop-in replacement" for CADO-NFS's sieving step.
How three weeks were spent
The first prompt went out at 0:11 AM; two hours later Lu added a requirement to handle RSA-250-scale parameters, then went to sleep. Devin iterated for seven more hours and got it running. Lu then climbed a scaling ladder: C155, C157, C173, C175, C190, C201, C311. Day one: a 157-digit number took 3h11m; by day five, a 190-digit number took 3h10m. Polynomial selection started August 18 at 12:14; factors landed September 3 at 01:48—15.6 days of mainline run, about three weeks total including engineering.
Where the money went
| Stage | GPU-days | Notes |
|---|---|---|
| Polynomial selection | 643 | Lu self-assessed as "unusually high, mostly due to operator incompetence" |
| Lattice sieving | 3,813 | Most expensive; two glas upgrades gave 14–17% speedups |
| Linear algebra | 467 | ~7% lost to crashes or preemption |
Total: 4,923 GPU-days (~13.5 GPU-years), ~$414,000 at $3.5/GPU-hour. Sieving produced 13.85 billion raw relations, deduplicated to 8.299 billion unique (40.1% duplicates), yielding a 656,182,601 × 656,182,189 matrix with 98.4 billion nonzeros (~150 per row).
What the human actually did
Lu, not a cryptographer, compares himself to a "mid-level car enthusiast": he knows what parts do and what counts as normal operation, but not the underlying physics. Math consulting came from Alex Lombardi. His own tally: 233 factoring sessions, 14,450 ACU total; 3,328 messages, 82,702 words across 192 sessions. Devin spawned 101 sub-sessions, 36 with zero human involvement. Peak concurrency: 18 sessions; average: 3.
Of his seven listed contributions, five were executive functions: setting goal hierarchies, stopping wasted work, pointing out repeated inefficiencies, suggesting unexplored directions (e.g., NVLink SHARP), and catching premature give-ups. His self-declared biggest contribution was establishing a unified system of measurements, benchmarks, and performance estimators—things that would not emerge spontaneously. He also observed that the further the codebase drifted from upstream CADO-NFS, the more the agent got confused; without CADO-NFS's stage structure, interfaces, and CPU reference implementation, this would have been impossible.
Is encryption still safe?
Cognition's extrapolation: RSA-1024 (309 digits) is only ~78× harder than RSA-260 under standard GNFS scaling—roughly $30 million per number at market rates, possibly halved with further optimization. RSA-1024's insecurity is not news; it was deprecated in 2013. RSA-2048 is about a billion times harder than RSA-1024. In Lu's words, these efficiency gains have "little impact on the feasibility of factoring RSA-2048-scale numbers with GNFS." This is a cost event, not a cryptographic one.
After the barrier drops
The barrier that fell was engineering execution, not problem definition. Lu's heaviest work was slicing a fuzzy goal into stages with stable interfaces and reference outputs—a structure inherited from CADO-NFS's two decades of accumulation, not invented by the agent.
One accounting note: the project ran on fragmented spare capacity of Cognition's own cluster (idle single nodes in NVL72 racks), which Lu says had "no marginal cost" since that compute had no other use; the $400K figure is opportunity cost, not cash spent.
The thing to watch is not when RSA-1024 falls, but whether this playbook replicates: any research problem decomposable into "reference implementation + measurable benchmarks + many independent subtasks" is a candidate for agent-swarm progress—molecular docking, lattice QCD, and large-scale combinatorial search are on the list.
Sources
1. Cognition blog, "Factoring RSA-260", Eric Lu, 2026-09-09 — https://cognition.ai/blog/factoring-rsa-260 2. Senthorus Blog, "Inside the RSA-260 Factorization: GPU-Accelerated GNFS and the Role of Devin", Guillaume Dumas — https://blog.senthorus.ch/posts/rsa_260_factorization_cognition_explanation 3. AI Watch Station, "Cognition Says Devin Helped Factor RSA-260" — https://ai-watch-blog.vercel.app/en/posts/2026-09-09-devin-rsa-260-factoring 4. FreeAI, "How a Swarm of AI Agents Factored RSA-260 in Three Weeks for $400K" — http://freeai.help/blog/how-a-swarm-of-ai-agents-factored-rsa-260_en 5. FrontierNews, "How One Engineer and an AI Coding Agent Factored a 260-Digit Number" — https://www.frontiernews.ai/news/article/how-one-engineer-and-an-ai-coding-agent-factored-a-61ea84c8