RSA-260 Factored by AI: What It Means for RSA-1024 Keys

Cognition's Devin AI coding agent factored RSA-260, a 260-digit number, setting a new record for the RSA Factoring Challenge and beating the previous RSA-250 record from February 2020. Eric Lu, a researcher at Cognition, spent three weeks directing multiple Devin sessions to build a GPU-accelerated version of the general number field sieve, running the computation on spare capacity left over from the company's LLM training clusters. The factorization cost roughly $400,000 in GPU time — and the same approach puts RSA-1024 within reach of anyone willing to spend around $30 million.

Key Takeaways

• Cognition's Devin agent built a GPU-accelerated GNFS pipeline that factored RSA-260 (a 260-digit, 862-bit number), the largest publicly solved RSA Factoring Challenge problem, beating the previous RSA-250 record from February 2020
• The run cost about 4,900 GPU-days (roughly $400,000 at market GPU prices), split across 643 GPU-days for polynomial selection, 3,813 for sieving, and 467 for linear algebra
• Researcher Eric Lu reports no algorithmic breakthrough — the gains come from adapting an existing CPU-based pipeline, CADO-NFS, to GPUs through performance engineering alone
• RSA-1024 is only about 78x more computation than RSA-260, putting its estimated factoring cost around $30 million — and Lu thinks further optimization could cut that by another 2x
• RSA-2048, today's standard key size, remains roughly a billion times harder than RSA-1024 and isn't meaningfully affected by this work

What exactly did Devin factor?

RSA-260 is a 260-digit (862-bit) semiprime from the old RSA Factoring Challenge, a benchmark RSA Laboratories used to gauge how hard it is to break the RSA cryptosystem before ending the challenge in 2007. Lu factored it using the general number field sieve (GNFS), the standard algorithm for numbers this size, running on a heavily modified version of CADO-NFS, an open source GNFS implementation used in prior factoring records. For scale: 1024-bit RSA keys (roughly 309 digits) were deprecated back in 2013, and current 2048-bit keys run around 617 digits.

How much did the factorization actually cost?

Lu estimates the whole run at about 4,900 GPU-days, or 13.5 GPU-years, worth roughly $400,000 at current GPU market prices. GNFS breaks down into three sequential stages, and the GPU-days split unevenly across them: 643 GPU-days on polynomial selection (Lu says this ran anomalously long due to an operator mistake, not a technical limit), 3,813 GPU-days on lattice sieving, and 467 GPU-days on linear system solving. Sieving alone produced nearly 14 billion relations before filtering them down to about 8.3 billion unique ones. None of this ran on dedicated hardware — it used idle or fragmented capacity from Cognition's LLM training clusters, nodes that would otherwise have sat unused between larger jobs, so the marginal cost was effectively zero beyond the researcher's own time.

How much of this did Devin actually do on its own?

Lu's own account is careful not to overstate Devin's independence. He kicked things off with a single prompt asking Devin to build a GPU replacement for CADO-NFS's CPU lattice siever, gave it access to one test GPU, and went to bed — waking up nine hours later to a working prototype that beat the CPU version. Over the following three weeks he ran an average of 3 and a peak of 18 concurrent Devin sessions, and by his own tally sent over 82,000 words across more than 3,300 messages in 192 of the 233 sessions used for the project. Devin rewrote nearly every stage of the CADO-NFS pipeline for GPUs — polynomial selection, the lattice siever, the workunit server, the linear algebra solver, and the final square-root step — but Lu describes his own role as executive function: setting priorities, catching when Devin was measuring the wrong thing, and pointing out optimization directions it hadn't tried. He's explicit that this wasn't an agent deciding on its own to go break RSA.

What does this actually mean for RSA-1024 and RSA-2048?

Lu is upfront that RSA-1024 being weak isn't news — researchers speculated intelligence agencies could feasibly break it as far back as the mid-2000s using specialized hardware designs like TWIRL. What changes here is who can do it and how cheaply: instead of building custom silicon, you now just need enough GPUs. Using GNFS's standard scaling, RSA-1024 (309 digits) is about 78 times more computation than RSA-260, which puts its cost at roughly $30 million at market GPU prices — and Lu suspects a further 2x reduction is plausible with more optimization. RSA-2048 is a different story entirely: it's roughly a billion times harder than RSA-1024, and Lu says the GPU speedups here don't meaningfully touch its security margin.

Should this change anything in your own stack?

If you still have RSA-1024 keys anywhere — old TLS certificates, DKIM records, embedded device firmware, or archived traffic someone might try to decrypt later — this is a good prompt to finish migrating off them, even though the underlying weakness isn't new. RSA-2048 remains the practical floor for new deployments and isn't affected by this work. For anything provisioned today, that's still fine; just don't assume RSA-1024 is a safe fallback anywhere in a system you're responsible for.

Wrapping Up

The bigger story here isn't really about cryptography — it's that a research problem which reportedly would have needed a multi-month effort from a team of specialists took one researcher and an AI agent three weeks as a side project. If your systems have RSA-1024 lurking anywhere, this is as good a reason as any to finally retire it.

Sources

Cognition — Factoring RSA-260