On September 3, 2026, the RSA Factoring Challenge recorded its latest milestone: RSA-260, a 260-digit (862-bit) semiprime, was factored into two 130-digit primes. The factorization was performed by Eric Lu and the Cognition research team using a new GPU-accelerated implementation of the General Number Field Sieve (GNFS), the most efficient known algorithm for factoring integers above roughly 100 digits. The previous public record, RSA-250 (250 digits, 829 bits), was set in February 2020 by an international academic collaboration.
The image depicts the outcome of factoring RSA-260, highlighting the successful decomposition of the 260-digit semiprime into its prime factors, which aligns with the article's discussion of the milestone.
## How the factorization was achieved
The General Number Field Sieve proceeds in three main sequential stages: polynomial selection, lattice sieving, and linear system solving. Polynomial selection chooses the algebraic number field that maximizes the yield of useful relations during sieving. Lattice sieving, the most computationally intensive stage, searches for smooth numbers — integers that factor completely into small primes — by evaluating a polynomial at billions of "special-q" lattice points. Each work unit performs a large number of reads and writes at pseudorandom locations in a large array, a memory-access pattern historically difficult to optimize on GPUs. The resulting relations are assembled into a massive sparse matrix over GF(2), and the block Wiedemann algorithm finds a linear dependency that yields a congruence of squares modulo the target number, from which the factors are derived.
Cognition's implementation, built by modifying the open-source CADO-NFS suite, replaced nearly every component:
- A GPU-adapted stage-1 polynomial selection (gps1), incorporating kernels from msieve - A new GPU lattice siever (glas) replacing CADO's CPU-only las - An optimized CADO head to handle the massive workunit volume - Parallelized duplicate removal, purge, and fused merge/replay programs - A GPU-optimized block Wiedemann linear solver - GPU-accelerated square-root step - Associated orchestration scripts
Only cado-nfs.py itself, stage-2 polynomial selection (polyselect_ropt), makefb, and dup1 remained untouched.
The project reports no algorithmic breakthroughs; the gains come from "good old performance engineering" that exploits the high memory bandwidth of modern GPUs. The lattice siever was the primary technical challenge: efficiently handling pseudorandom memory access patterns at scale required extensive kernel optimization and memory-system tuning.
## Cost and compute
The factorization consumed approximately 4,900 GPU-days (13.5 GPU-years), broken down as:
- 643 GPU-days for polynomial selection (noted as anomalously high due to operator error) - 3,813 GPU-days for lattice sieving - 467 GPU-days for linear system solving (about 7% lost to crashes or preemption)
At current market GPU prices, this corresponds to roughly $400,000. Critically, the computation ran at **no marginal cost** on spare or fragmented compute from Cognition's LLM training clusters. These clusters use NVL72 racks — each containing 18 computers interconnected by NVLink — and the job scheduler must pack workloads into racks to exploit the fast interconnect. This packing leaves a single-digit percentage of nodes idle or underutilized (e.g., racks with 17 instead of 18 active nodes, or nodes reserved for failover). The team rigged their scheduler to fill these gaps with low-priority, preemptible lattice-sieving jobs, which are embarrassingly parallel, safe to preempt instantly, and constitute the bulk of GNFS work.
## Implications for RSA key sizes
RSA-1024 (309 decimal digits, 1024 bits) is estimated to require roughly 78× more computation than RSA-260 under standard GNFS scaling. At market GPU prices, this translates to approximately $30 million per number, with wall-clock time tradable against cost by adding more GPUs. The author notes the current implementation remains significantly suboptimal and expects moderate further work could reduce this cost by another factor of 2 or more.
The insecurity of RSA-1024 is not new: speculation about nation-state capability to factor RSA-1024 economically dates to the mid-2000s (e.g., the TWIRL and Bernstein matrix machine proposals). What changes with this work are three factors: (1) potentially lower dollar and time cost, (2) more parties capable of performing the computation using commodity GPUs rather than specialized hardware, and (3) the relative ease with which non-cryptographers can now optimize factoring code using AI-assisted engineering.
By contrast, RSA-2048 (617 decimal digits, 2048 bits) is roughly a billion times harder than RSA-1024 under GNFS. The efficiency gains demonstrated here have little impact on its feasibility.
## Context: the RSA Factoring Challenge
The RSA Factoring Challenge was launched by RSA Laboratories in 1991 to encourage research into integer factorization and benchmark the practical security of RSA key sizes. The challenge published a list of semiprimes (numbers with exactly two prime factors) with cash prizes for their factorization. The challenge ended in 2007 after the industry gained a more advanced understanding of cryptanalytic strength; at that time, only RSA-576 and RSA-640 from the expanded 2001 challenge had been factored. RSA-260, factored after the challenge's conclusion, continues the sequence of decimal-digit-labeled numbers (RSA-100 through RSA-500) and represents the largest publicly solved instance to date.
## Open questions and limitations
The $400,000 market-cost estimate assumes current GPU pricing and the specific implementation achieved. One comment on the announcement notes that modern CPU hardware (e.g., 96-core AMD EPYC) has improved integer performance substantially since the 2017-era Skylake Xeon baseline used for the RSA-250 cost comparison, potentially narrowing the CPU-GPU cost gap. The factorization also depended on access to a large GPU cluster with significant idle capacity — a resource not available to most actors. An adversary with a botnet or stolen cloud credentials could amortize the lattice-sieving stage differently, though the linear algebra stage demands high-bandwidth interconnect (Infiniband/NVLink) that is harder to replicate on heterogeneous or untrusted infrastructure.
No algorithmic improvements to GNFS were discovered; the work demonstrates the power of performance engineering when guided by an autonomous agent capable of iterative experimentation, measurement, and cluster orchestration. The author, a self-described non-expert in the underlying number theory, directed Devin at a high level — setting priorities, establishing benchmarks, and recognizing when work went off-track — while the agent handled measurement, optimization, and end-to-end pipeline execution over three weeks with an average of three and up to 18 concurrent sessions.
This result underscores that the barrier to entry for large-scale computational mathematics and scientific computing research is substantially lower than before, provided one has access to sufficient GPU compute and tooling that can automate the engineering cycle.