Cognition’s Devin Built a GPU Number Field Sieve and Factored RSA-260, Cutting the Price of Breaking RSA-1024 to $30 Million

3 Sep 2026 – Eric Lu, a researcher at the AI company Cognition, posted a prime factor of RSA-260 on X. The 260-digit, 862-bit number, part of the RSA Factoring Challenge that RSA Laboratories launched in 1991, became the largest challenge number factored in public, breaking a record that had stood since February 2020.

On September 9, Lu described the method. He credited Cognition’s Devin software-engineering agent with building and running a GPU version of CADO-NFS, open-source software for the general number field sieve (GNFS), the fastest known classical algorithm for factoring numbers of this size. A hyperscaler or frontier AI lab could factor a 1,024-bit RSA number for about $30 million at market GPU prices, Lu estimated, and likely for substantially less with more optimization.

Lu rejected claims circulating on X that he had found the factors by testing random primes by hand. He also wrote that Cognition has not yet built a multi-thousand-qubit quantum computer.

Each of the two factors has 130 digits and passes standard primality tests. Their product matches the RSA-260 value and checksum in RSA Laboratories’ published challenge list.

The previous record was the 829-bit RSA-250, factored in February 2020 by Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé and Paul Zimmermann, who ran CADO-NFS on CPUs at a cost of about 2,700 core-years on 2.1 GHz Intel Xeon Gold 6130 processors. Before Lu’s post, no one had publicly factored an RSA challenge number larger than RSA-250 in six and a half years. RSA Laboratories ended the challenge in 2007.

Lu put RSA-2048, the current standard key size, at roughly a billion times the difficulty of RSA-1024. He wrote that RSA-2048 does not appear to be meaningfully affected by his work.

How Devin Built the GPU Pipeline

Lu wrote that shortly after midnight on August 13 he asked Devin, in a short prompt, for a drop-in GPU replacement for las, the CPU lattice siever in CADO-NFS. He gave the agent access to a single test GPU and went to bed. About nine hours later, Devin had a GPU siever, named glas, that beat the CPU version.

Over the following week, Lu directed Devin to optimize the sieving and then the remaining stages of the GNFS pipeline. Cognition listed the components Devin built: a GPU-adapted version of CADO-NFS’s polynomial selection using code from msieve, an optimized CADO-NFS server to handle the volume of work units, parallelized versions of the filtering programs, a GPU block Wiedemann implementation for the linear-algebra stage and GPU-accelerated code for the final square-root step.

Lu described his own contribution as direction and oversight: setting priorities and benchmarks, and spotting work that had gone off track. He estimated that the agents did work that would otherwise have taken a team of specialists several months.

By Devin’s count, Lu sent 3,328 messages in 192 of the 233 sessions used for factoring, totalling 82,702 words. Devin instances started 101 child sessions themselves. Lu did not intervene in 36 sessions.

Compute, Hardware and Cost

The factorization took about 4,900 GPU-days, or 13.5 GPU-years, on Nvidia B200, GB200 and GB300 GPUs, according to Lu, who valued it at roughly $400,000 at market prices. The time broke down as follows: sieving 3,813 GPU-days, linear algebra 467, and polynomial selection 643, a share Lu called anomalously high and blamed on his own operating mistakes.

Lu took on the project as a proof of concept for Cognition’s work on scheduling jobs onto idle compute, and because he has factored numbers as a hobby for about ten years. When Cognition packs its training and inference jobs into Nvidia NVL72 racks of 18 nodes each, some racks are left with a node or two idle. Lu put that idle capacity at a single-digit percentage of the cluster and wrote that running the factorization on it had no marginal cost.

The linear-algebra stage requires all of its workers to stay up simultaneously. Lu reported that it was frequently preempted by higher-priority work. Its matrix had about 656 million rows and 98 billion nonzero entries.

Lu described glas as the world’s highest-performing GPU lattice siever and wrote that his pipeline factors numbers at a tenth of the cost of the previous public state of the art. In that comparison, he priced CPU time at $0.08 per core-hour and GPU time at $3.50 per hour. The CPU baseline was scaled from the RSA-250 computation.

Before Cognition published its account, Emmanuel Thomé of Inria, a member of the RSA-250 team, told Scientific American that RSA-260 was expected to take roughly three times the computation of RSA-250.

In an appendix, Lu also reported a complete factorization of the 385-digit Mersenne number $$2^{1277}-1$$ and described it as a new record for the special number field sieve.

My Analysis

The 1,024-bit RSA keys still found in email authentication records, embedded devices and archived traffic should now be treated as breakable by any organization with a large GPU fleet and a budget in the tens of millions. RSA-2048, the standard key size, remains roughly 91 billion times harder to factor than RSA-260, and the only practical route to it is still a cryptographically relevant quantum computer that does not yet exist.

How Much of the Claim Can Be Checked

I multiplied Lu’s two primes and got the RSA-260 value published with the original challenge, and I confirmed the checksum RSA Laboratories printed beside each number: N mod 991889 = 327430. Both factors pass a primality test.

I reproduced Lu’s cost table with the standard heuristic for how GNFS work scales with key size, using the function $$L[1/3, (64/9)^{1/3}]$$ applied to each number’s exact bit length. My ratios match his: RSA-250 at 0.385 of the RSA-260 effort, RSA-1024 at about 78 times, and RSA-2048 at about 91 billion times.

Everything beyond the factorization itself is Lu’s account. The GPU-days, the stage breakdown, the session counts and Devin’s role are self-reported. Lu’s write-up is unusually detailed for a factoring-record announcement, with timestamps, a full polynomial, matrix dimensions and per-workunit sieving data in his appendix, and anyone with the hardware and access to CADO-NFS can try to reproduce the stages he describes. Still, no third party has yet published an independent measurement.

What an AI Agent and Idle GPUs Added to the Number Field Sieve

Six and a half years passed between RSA-250 and RSA-260, even though CADO-NFS was open source throughout and Nvidia shipped several generations of GPUs with far more memory bandwidth. Lu gave the reason in his write-up. Every team behind an earlier public record sieved on CPUs, because CPU-optimized lattice sieving relies on heavy branching and scattered memory access, both of which run poorly on GPUs, and no one knew whether a GPU siever could pay for itself.

In his first prompt to Devin, Lu described the obstacle as a shortage of people: very few are expert in both GPU kernel programming and number field theory.

Devin supplied that combination and produced a working GPU siever that beat the CPU original overnight. Lu wrote that the agents handled measurement, cluster operations and optimization on their own. He kept the priorities and the benchmarks for himself, along with the job of spotting drift. His description of the division of labour is consistent: Devin needed him for executive function, he said, and he kept lists of concrete goals, recognised when Devin was going off track, and drove the optimization priorities. The agent’s contribution was engineering throughput across a broad technical surface.

The compute ran on capacity that Cognition had no other use for. Training and inference jobs fill NVL72 racks in groups of nodes connected by fast NVLink. Some racks are left with a node or two idle. Lattice sieving can be split into billions of small work units that can be stopped at any moment without loss, which is why Lu chose it as filler for those stranded nodes. At the $3.50 per GPU-hour that he used for his estimates, 13.5 GPU-years would cost about $400,000 on the rental market, but Lu wrote that his actual marginal cost was zero.

In July, Anthropic said its Claude Mythos Preview model had developed a key-recovery attack on HAWK, a candidate in NIST’s additional post-quantum signature process. Zygimantas Straznickas and Stephen A. Weis, the two Anthropic researchers, published the attack, and the HAWK team withdrew the scheme the following day. I covered the HAWK result and a related attack on seven-round AES as a change in what it costs to find a flaw in an algorithm. Lu and Devin did the equivalent for running a known attack at scale: the mathematics of the general number field sieve has not changed, but an AI agent wrote a competitive GPU implementation of it in nine hours and then ran a fleet of GPUs through a three-week project with limited human steering.

What Factoring an RSA-1024 Key Costs Now

Lu put RSA-1024 at about 78 times the work of RSA-260 under the standard GNFS scaling heuristic, roughly 1,050 GPU-years, or about $30 million at $3.50 per GPU-hour. He wrote that he expected moderate further work to cut that cost by half.

On the CPU side, his table prices RSA-1024 at about $383 million in Xeon core-hours at $0.08. A hobbyist cannot factor RSA-1024 on either path. A hyperscaler, a frontier AI lab, or a well-funded state program can, and anyone with tens of thousands of idle GPUs and a few months of wall-clock time could do it at a fraction of the sticker price.

Cryptographers have long speculated that the NSA could factor 1,024-bit keys economically as early as the mid-2000s, and Lu pointed to the same history: special-purpose hardware designs like TWIRL, proposed by Adi Shamir and Eran Tromer in 2003, were sized for exactly that purpose. Lu’s contribution is not the observation that RSA-1024 is insecure. It is a detailed public account of the cost, the hardware and the division of labour between a human and an AI agent, at a price that several dozen organisations could pay today.

Where 1,024-Bit RSA Keys Are Still in Use

NIST has disallowed RSA keys shorter than 2,048 bits for new signatures and for key transport since the start of 2014, and the CA/Browser Forum required 2,048-bit keys for any web certificate valid past 2013. Twelve years on, 1,024-bit keys remain common in three kinds of system.

Email signing. Mail providers use DKIM signatures to check that a message came from the domain it claims. Under RFC 8301, DKIM signers must use RSA keys of at least 1,024 bits and should use at least 2,048. DMARC.org, working from DomainTools data, reports 1,024 bits as one of the two most common RSA key sizes among the DKIM keys it observed in 2025. Anyone who factors a domain’s DKIM key can sign mail that passes DKIM checks for that domain. Whoever holds the factors can also forge messages that appear years old, so nothing signed with that key can be trusted as proof of origin. That is trust now, forge later without a quantum computer.

Recorded traffic. Many TLS servers once used RSA key transport, in which the client encrypts the session secret with the server’s RSA public key. The IETF removed the method from TLS 1.3 in 2018. Anyone holding a recording of such a session and the factors of a 1,024-bit server key can decrypt it. For traffic from before the 2013 certificate cutoff, an adversary practising harvest now, decrypt later no longer needs a quantum computer; one factorisation per server key is enough.

Keys burned into devices. Where a device’s firmware-verification key was set at manufacture as 1,024-bit RSA, whoever factors that key can sign firmware the device will accept. The owner has no way to rotate the key.

When I find RSA-1024 in production twelve years after NIST disallowed it, I take it as the best available forecast of how that organisation will meet its post-quantum deadlines.

Why RSA-2048 and Q-Day Are Unaffected

Factoring RSA-2048 under the same GNFS heuristic takes about 91 billion times the work of RSA-260. In Lu’s table, that comes to roughly 1.2 trillion GPU-years. No one will close that gap with GPUs, and Lu said as much.

RSA-2048 will be broken by Shor’s algorithm running on a CRQC. The estimate I use is Craig Gidney’s from May 2025: a quantum computer with fewer than a million noisy physical qubits could factor RSA-2048 in under a week, assuming a 0.1% gate error rate and a one-microsecond error-correction cycle (arXiv:2505.15917). Lu’s record is a classical computation and has no effect on that estimate or on the hardware it assumes.

Some people look at the classical record of 862 bits next to the Shor’s-algorithm record on real hardware, still the number 21, and conclude that quantum factoring is hopeless. They have the scaling backwards. RSA-260 is 33 bits longer than RSA-250 and took about 2.6 times the classical work, because GNFS cost rises sub-exponentially with key length. Shor’s algorithm scales polynomially, so a fault-tolerant machine large enough for RSA-2048 would not need to work its way up through RSA-260 first.

Any vendor who claims an AI or quantum break of RSA-2048 should meet the same test Lu met: publish the factors and let anyone check.

What to Do About RSA-1024 This Quarter

• Find every RSA key shorter than 2,048 bits. Include DKIM selectors, SSH host keys, signing certificates for code and documents, HSM keys kept for legacy protocols, and verification keys compiled into firmware. Teams running a cryptographic inventory for post-quantum migration will find them. These keys are the cheapest findings in that inventory to fix.
• Rotate DKIM keys to 2,048-bit RSA. Add an Ed25519 signature alongside where your provider supports it. Red Sift tested 19 mailbox providers in April and found that fewer than half validate Ed25519. Six of them still accepted 512-bit RSA keys, a size first factored in 1999.
• Assume recorded RSA-1024 sessions are readable. Any session protected by RSA key transport with a 1,024-bit server key can be decrypted by whoever recorded it and pays for the factorisation. Rotate any credential or long-term key that crossed such a channel and is still valid.
• Replace or isolate devices that verify firmware with a 1,024-bit RSA key they cannot rotate. They will accept firmware signed by anyone who pays for the factorisation.
• Leave the post-quantum roadmap alone. RSA-2048 is unaffected. A vendor who cites this record to sell quantum-safe urgency is selling on the wrong evidence; the case for migration is the one that existed on September 2.
• Fund crypto-agility as its own workstream. This summer an AI model found a flaw in a NIST PQC candidate, and an AI agent built a GPU pipeline that cuts the price of an RSA-1024 factorisation by an order of magnitude. Organisations that can change algorithms on a schedule handle both kinds of news as routine work.

Lu ended his write-up with a challenge to others. He wrote that the agents and the compute exist elsewhere, that the implementation is still substantially suboptimal, and that he encouraged everyone to be ambitious and explore what autonomous software-engineering agents can do when applied to these fields.

I take that at face value. Every frontier AI lab has idle GPU capacity, models capable of writing CUDA kernels, and researchers who know what to point them at. If no one else reproduces or extends this result in the next few months, that will be more surprising than the record itself.