Both numbers are far smaller than the RSA-2048 standard, so they pose no real threat to current encryption systems.
Cracking a 2,048-bit key would cost quadrillions of dollars, but AI makinng large-scale computation easier is a promising advancement.
Within the month of September, two record-setting Rivest-Shamir-Adleman (RSA) factorizations were announced back to back, both accomplished with the help of AI coding agents. Cognition researcher Eric LU used the company’s Devin agents to factor RSA-260 on Sept. 3. 16 days later, Stephen A. WEIS, a security engineer at Anthropic, used Claude to factor the larger RSA-896. For anyone who trusts encryption to protect their private information, the pace raises an obvious question: how much closer are computers to breaking the keys used today?
RSA is a widely used encryption algorithm named after its three cocreators, globally used in securing web traffic, email security, digital signatures and so much more. It fundamentally relies on a simple asymmetry in mathematics: multiplying two large prime numbers is easy for a computer, but working backwards from the products to find the primes is not. In a typical RSA key, that product is public while the primes stay secret; recovering them lets an attacker rebuild the private key to decrypt encrypted messages or to forge digital signatures.
RSA-260 is named after its 260 decimal digits, which is equivalent to 862 bits, while RSA-896 is named for its 896 bits, or about 270 decimal digits. This quirk is due to the change in naming standards since RSA-260 was defined in 1991 when the original challenge was defined, and RSA-896 was named in 2001, after it became standard to use bit notation over decimal to avoid confusion. These numbers may seem intimidating—these are such massive numerals, that perhaps one may worry that modern cryptosystems may be in danger. However, both RSA numbers are rather smaller than RSA-1024, which was standard up to 2013, and significantly smaller than RSA-2048, the current global standard as recommended by the United States National Institute of Standards and Technology (NIST).
Lu’s account gives the fuller picture on how his results came together. He directed Devin, Cognition’s autonomous coding agent, to build a GPU-based version of CADO-NFS: an open-source software that implements the general number field sieve, the standard algorithm for factoring numbers of this scale. Devin handled the setup and management of each computational experiment, Lu said, while he set priorities and stepped in when there were major issues. He describes his own contribution to the achievement modestly, comparing Devin (and such agents) to “a sewing machine or a loom.” Lu states that he has nudged Devin constantly, and the result evidently would not have happened without him. Yet, Lu also acknowledges that he feels a sense of detachment. The project ran about three weeks, approximately costing 4,900 GPU-days—400,000 USD at market prices—using spare cluster capacity that would otherwise have gone unused.
Weis, whose past works include Google’s two-step verification and the Keyczar cryptography library, described a similar setup on a much shorter timeline. He had Claude port the same CADO-NFS software to GPUs, then had it coordinate a fleet of machines running on scavenged idle capacity, like Lu. At its peak, the effort spanned 2,048 GPUs and accumulated roughly 30 GPU-years of processing time, over the span of 10 real life days. Weis was direct about what the milestone didn’t mean: no new algorithmic improvements, no change to the method’s exponential difficulty, and no new threat to deployed keys. Asked for a public comment on its own, Claude, in Weis’s telling, pointed credit toward “the people who built the field sieve” and the researchers behind the original CADO-NFS and earlier records. Weis added a dry aside: perhaps given the computational cost, mining cryptocurrencies would have had more financial sense.
But how does any of this affect the average person? Lu estimates that a 1,024-bit key, already deemed too weak for real use since 2013, could be factored today for around 30 million USD in GPU time. A 2,048-bit key, the current standard, is roughly a billion times harder still, by his own estimate, putting the projected cost at tens of quadrillions of dollars: just to solve a single encryption. Neither result demonstrates a workable attack on properly generated keys, and two records in a month say little about when the rest will fall.
Two records fell within sixteen days, and neither poses a real threat to today’s encryption. But as AI agents make large-scale computation like this easier to launch, the gap between “very hard” and “not hard enough” is one worth watching, even if there is no reason to panic yet.
