How was RSA-260 factored?

Cognition's Devin agents implemented a GPU version of the general number field sieve (GNFS), a heavily modified CADO-NFS, with lattice sieving and sparse linear algebra moved to GPUs. No algorithmic breakthroughs were involved — only performance engineering on NVL72 GPU racks.

How much did the RSA-260 factorization cost?

About 4,900 GPU-days (13.5 GPU-years), roughly $400k at market GPU prices, but it ran on spare or fragmented cluster compute at no marginal cost. The stages split into 643 GPU-days of polynomial selection, 3,813 GPU-days of sieving, and 467 GPU-days of linear algebra.

Does this mean RSA-1024 is broken?

RSA-1024 now costs an estimated ~$30M to factor with this GPU GNFS approach — hyperscaler territory rather than nation-state only, possibly 2x cheaper with more optimization. RSA-2048 remains roughly a billion times harder and is not meaningfully affected by this work.

Is the factorization real?

Yes. I independently verified it in Python: the product of the two published 130-digit factors equals the 260-digit RSA-260 exactly, and both factors pass a 20-round Miller-Rabin primality test. Factorization claims are trivially self-verifiable arithmetic.

Cognition's RSA-260 Factorization: Verified, Costed

Cognition published a factorization of RSA-260 yesterday — 260 digits, the largest publicly solved RSA Factoring Challenge number since RSA-250 fell in February 2020. The twist nobody expected: it wasn't a crypto team or a supercomputer center. It was a swarm of Devins running on spare LLM-cluster compute. Before you take it as gospel, note that factorizations are the one claim in math you can check with one line of code. So I did.

I Verified It Myself — Here's the Command

The blog post gives the 260-digit composite and two 130-digit factors. Verification is pure arithmetic:

n = 22112825529529666435281085255026230927612089502470015394413748319128822941402001986512729726569746599085900330031400051170742204560859276357953757185954298838958709229238491006703034124620545784566413664540684214361293017694020846391065875914794251435144458199
p = 4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581
q = 5028695206842569864686141618253083416610081090075366674776775706538324961364412200138116378509733307971876652984898985905923678379
print(p * q == n)  # True

Result: True. Both factors are exactly 130 digits, and a 20-round Miller-Rabin confirms each is (probable) prime. The claim holds. That's the beauty of factorization results — no peer review needed, the product is the proof.

How They Did It: GPUs, Not Algorithms

The key detail: no algorithmic breakthroughs. Eric Lu's write-up is explicit — they took CADO-NFS (the standard general number field sieve implementation) and rebuilt the lattice sieving and sparse linear algebra for GPUs. "Good old performance engineering," leveraging the absurd memory bandwidth of an NVL72 rack. The Devin agents built what they claim is the world's fastest GPU lattice siever, at 10x lower cost than prior public state of the art.

The cost breakdown is the most honest I've seen from an AI lab:

643 GPU-days — polynomial selection (self-admittedly bloated by "operator incompetence")
3,813 GPU-days — lattice sieving, the bulk of the work
467 GPU-days — linear system solving, 7% wasted on crashes and preemption
Total: 4,900 GPU-days ≈ 13.5 GPU-years ≈ $400k at market rates — and effectively free, since it ran on fragmented spare compute

graph TD
    A[Spare GPU capacity on NVL72 racks] --> B[Devin swarm: modified CADO-NFS]
    B --> C[Polynomial selection
643 GPU-days]
    B --> D[GPU lattice sieving
3,813 GPU-days]
    B --> E[GPU linear algebra
467 GPU-days]
    C --> F[RSA-260 factored
~4,900 GPU-days / $400k]
    D --> F
    E --> F

The $30M Line in the Sand

The number that matters isn't 260 digits. It's the scaling: RSA-1024 (309 digits) is only ~78x more work under GNFS scaling. Lu estimates factoring RSA-1024 at roughly $30M — hyperscaler money, not nation-state money — and thinks another 2x is on the table. RSA-2048 remains ~a billion times harder, so your modern keys are untouched. But the 1024-bit keys still floating around legacy systems just moved from "theoretically breakable by intelligence agencies" to "a line item a well-funded company could approve."

The deeper shift is who can do this work. TWIRL and Bernstein's matrix machine predicted nation-state capability in the mid-2000s. This changes the supply curve: you need GPUs and an agent that can do performance engineering, not a bespoke hardware program. As Lu puts it, the barrier to entry for cryptanalysis and computational mathematics "is far lower than it used to be."

What This Actually Proves About Agents

Strip the crypto drama and this is an agents-at-scale result: Devin autonomously handled measurements, cluster operations, and GPU optimization end-to-end. The human's job was priorities, benchmarks, and course-correction. The headline claim — replacing "a multi-month effort by a team of highly specialized domain experts" with a swarm on idle compute — is the strongest evidence yet that frontier agents can carry performance-critical scientific computing, not just glue-code web apps.

My one pushback: the 643 GPU-days wasted on polynomial selection is exactly the kind of cost an expert team would never incur. Agents substitute compute for expertise. When compute is spare, that's free. When it isn't, expertise still wins.

Bottom line: I verified the factorization independently — the math checks out in one line of Python. RSA-2048 is safe; RSA-1024 legacy deployments just got a deadline they didn't have last week. And the agent story is real but costs compute: this is what "agent does expert work" looks like when you have a hyperscaler's leftovers. If you're still running 1024-bit RSA anywhere, start migrating now.

I Verified It Myself — Here's the Command

How They Did It: GPUs, Not Algorithms

The $30M Line in the Sand

What This Actually Proves About Agents

Related