News · 2026-09-10

An engineer factored RSA-260 by pointing coding agents at it

Eric Lu, an engineer at Cognition, factored RSA-260 — a 260-digit number that had stood unbroken since the RSA Factoring Challenge was published in 1991 — and described how in a post on Cognition's blog dated 9 September 2026. The computation took about 4,900 GPU-days, worth roughly $400,000 at market rates, and ran on spare cluster capacity at no marginal cost. The notable part is not the mathematics: Lu directed Devin coding agents to build the software that did it.

Key facts

• RSA-260 is 260 digits (862 bits); the previous public record, RSA-250, was set in February 2020
• The factorisation consumed 4,900 GPU-days — about $400,000 at market prices
• Published 9 September 2026 by Eric Lu of Cognition
• Primary source: Factoring RSA-260

What was actually broken, and what was not

Start with the reassurance, because the alternative reading of this story is a scare. The RSA Factoring Challenge is a published list of hard numbers designed to measure how far factoring technology has come. RSA-260 is one of them. It is not anybody's key.

Lu is explicit about the scale. Public keys in use today are 2048-bit, around 617 digits. The 1024-bit size, about 309 digits, was deprecated back in 2013. His estimate is that factoring a 1024-bit number would take roughly 78 times the computation he just spent — call it $30 million, and probably less with further tuning. RSA-2048, he writes, "remains roughly a billion times harder than RSA-1024 and does not appear to be meaningfully affected by this work."

So: nothing you use is newly broken. The 1024-bit sizes that this brings within reach of a well-funded organisation were already considered dead, and have been for over a decade.

How it was done

The method is the general number field sieve, the standard approach for factoring large numbers and the one used in every previous record. Lu's team started from CADO-NFS, the established open-source implementation, and substantially modified it to run on GPUs.

He is disarmingly blunt about the intellectual content: "I report essentially no algorithmic advancements — implementing lattice sieving and sparse linear system solving on GPUs required only 'good old performance engineering' to take advantage of the preposterous memory systems of the GPU."

The result was, by his account, the world's highest-performance GPU lattice siever, factoring numbers at roughly a tenth of the previous public state of the art's cost. The time went mostly into sieving — 3,813 GPU-days of the total — with 643 days on polynomial selection (anomalously high, Lu notes, "basically due to operator incompetence") and 467 on the linear algebra.

Think of the number field sieve as searching an enormous haystack for a very particular set of needles that, combined, reveal the factors. Nobody found a cleverer place to look. Somebody built a much faster machine for looking, and the machine was largely written by software agents.

The part that is actually new

"Devin is a sufficiently powerful software engineer to solve a challenging problem at the intersection of computational number theory and GPU performance engineering," Lu writes. "My role was primarily to set priorities, establish benchmarks, and recognize when work was going off-track. Devin otherwise autonomously handled measurements, cluster operations, and optimization end-to-end."

He estimates this substituted for what would have been a multi-month effort by a team of highly specialised experts. His conclusion is the sentence security teams should sit with: "the barrier to entry for cryptanalytic work, other computational mathematics more broadly, and likely most large-scale scientific computing research, is far lower than it used to be."

That is the security story, and it is not about RSA. Serious cryptanalytic engineering used to require a rare combination — deep number theory plus elite low-level performance work — that perhaps a few hundred people in the world possessed. If coding agents can supply the second half on demand, the population able to attempt this kind of work grows by orders of magnitude. Lu names the three real changes: lower dollar cost, more parties capable of doing it because commodity GPUs replace specialised hardware, and non-cryptographers now able to contribute to speeding up factoring.

It also fits a pattern Ground Truth has tracked all year, from a single git config line hijacking seven coding agents to Google reporting that attackers have moved from prompting models to running autonomous agents. Capability that used to be scarce is becoming purchasable.

The compute was free

One detail deserves its own note. The factorisation ran at no marginal cost on fragmented capacity — the leftover slices of clusters built for AI training and inference that cannot be packed into useful jobs. Lu did it as a side project using a single-digit percentage of Cognition's cluster while optimising the job scheduler.

The economics of cryptanalysis have historically been a strong deterrent: attacks are worth attempting only when the payoff exceeds a large, visible hardware bill. Waste heat from AI infrastructure weakens that assumption. The relevant question for a defender is no longer only "who would spend $30 million on this" but "who already owns enough idle GPUs that it costs them nothing."

The honest caveat

Every number here is Lu's own, self-reported in a company blog post, and the cost figures rest on his accounting of market GPU prices and on a scaling estimate for RSA-1024 that he acknowledges is imprecise and probably conservative. The factorisation itself is the exception and is not in doubt: he published both 130-digit prime factors, and anyone can verify the result in seconds by multiplying them together. Claims about what agents contributed versus what Lu directed are inherently harder to audit — there is no transcript — and come from a company that sells the agent.

Primary source, verified: read the paper →

Ground Truth. (2026, September 10). An engineer factored RSA-260 by pointing coding agents at it. Ground Truth. https://groundtruth.day/news/an-engineer-factored-rsa-260-by-pointing-coding-agents-at-it.html

@misc{groundtruth:an-engineer-factored-rsa-260-by-pointing-coding-agents-at-it,
  title  = {An engineer factored RSA-260 by pointing coding agents at it},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/an-engineer-factored-rsa-260-by-pointing-coding-agents-at-it.html}
}

Topics: cybersecurity · cryptography · ai-agents · vulnerabilities · cognition · autonomous-agents