By ByteBot
Cognition engineer Eric Lu ended a 35-year cryptographic standoff on September 3, 2026. He factored RSA-260 — an 862-bit, 260-digit number that RSA Laboratories issued as a challenge in 1991 and no one had managed to crack since. The tool that did the heavy lifting: Devin, Cognition’s AI software engineering agent, running parallel GPU-accelerated optimization sessions for about three weeks. The implication for developers isn’t a crisis. It’s a very specific audit checklist.
From Six Researchers to One Engineer and an AI
Context matters here. The previous record holder was RSA-250, factored in February 2020 by a team of six academics using distributed compute across tens of thousands of machines over several months. RSA-260 fell to a single engineer and an AI agent in roughly three weeks, at an estimated cost of $400,000 in GPU time.
The compute was real: approximately 4,900 GPU-days on NVIDIA GB200, GB300, and B200 hardware — about 13.5 GPU-years of aggregate work, parallelized into calendar weeks. No new mathematical tricks were invented. This was performance engineering, running the General Number Field Sieve (GNFS) via a heavily modified CADO-NFS — a standard open-source factoring framework — rewritten almost entirely for GPU execution.
What Devin Actually Did
This is where the story gets interesting for anyone building with AI agents. On August 13, Lu pointed Devin at las, the CPU lattice siever in CADO-NFS, and asked for a drop-in GPU replacement. An initial version beat the CPU reference after about nine hours. Over the following weeks, parallel Devin sessions benchmarked components, debugged failures, tuned parameters, prepared cluster scripts, and managed job runs.
Devin rebuilt the square root computation three times — first using GMP’s multi-precision functions, then parallel Karatsuba multiplication on CPU, then GPU-accelerated NTT multiplication, which was the version that produced the final factors. The last sqrt step ran in 88 minutes.
Lu’s role was direction, benchmark design, judgment, and verification. Devin’s role was implementation and iteration. This is not the narrative of AI writing a few helper functions. It’s an AI agent driving multi-week computational research across a pipeline with multiple interdependent components. Cognition’s full writeup details every stage of the process.
The Security Ladder: What’s Actually at Risk
RSA-260 is not used in any real cryptographic system. The practical security question is what this factorization tells us about the numbers that are in use.
- RSA-1024: Deprecated by NIST since 2013. Still present in legacy systems, IoT devices, old JWTs, and inherited codebases. Factoring it would require roughly 78x more computation than RSA-260 — an estimated $30 million and a few weeks on a hyperscaler cluster. Security researcher Steve Weis noted that a single modern hyperscaler cluster could factor an RSA-1024 key in weeks. Nation-states and well-funded actors are already in that range.
- RSA-2048: Current standard. Approximately one billion times harder than RSA-1024. Not affected by this work. Keep using it.
- RSA-4096: Well beyond any classical computing threat.
The quantum threat is a separate conversation. NIST’s post-quantum standards — ML-KEM, ML-DSA, SLH-DSA, FN-DSA — address attacks from quantum computers, not the classical GNFS-based factoring that broke RSA-260. Both timelines matter, but they are different problems.
What Developers Should Do Right Now
RSA-1024 has been deprecated for over a decade and this isn’t news to most security teams. But “deprecated” and “gone” are not the same thing, and the RSA-260 result is a useful reason to go find the stragglers. Security analysts at Senthorus put together a thorough breakdown of the implications.
- Audit your RSA keys. TLS certificates, SSH host and user keys, JWT signing keys, API authentication tokens, and code-signing keys. Any RSA key below 2,048 bits should be retired.
- Check inherited systems. IoT devices, internal tools, legacy APIs, and anything that hasn’t had a security review in a few years are the most likely hosts for sub-2048 keys.
- Plan your PQC migration. RSA-2048 is safe from classical attacks but faces the quantum timeline: NIST plans to deprecate it in 2030 and disallow it by 2035. If you’re in a regulated sector, that migration plan needs to exist now.
- Build crypto-agility into new systems. No hardcoded algorithms. Any new service or authentication component should allow algorithm swapping without a code change. Auditors will eventually look for this.
The Bigger Signal
The RSA-260 result is a cryptographic milestone. But the more forward-looking observation is what Devin’s role in it says about AI agents: one engineer with an AI coding agent completed a weeks-long, multi-component optimization project that previously required academic consortiums and months of distributed compute. The timeline compression is real.
That cuts in multiple directions. Defenders who can deploy AI-assisted security research get faster answers. So do attackers. The cost curve for serious cryptographic work has dropped sharply, and it will keep dropping. AlphaSignal’s coverage has a good rundown of the broader reaction. The action items above are not new — they have been on the list for years. The RSA-260 factorization is just a well-timed reminder to actually close them.
