Eric Lu, an engineer at Cognition, the company that makes the Devin AI coding agent, posted a 130-digit number on X on September 3, 2026, writing that it divides RSA-260. RSA-260 is a 260-digit, 862-bit number from the RSA Factoring Challenge, a list of numbers that RSA Laboratories published in 1991 to encourage research into the practical difficulty of factoring large integers.
RSA-260 is exactly divisible by Lu’s number. The result of that division is a second 130-digit prime, so the two numbers are the complete factorization of the challenge number.
As of September 4, Lu had shown that RSA-260 has been factored without disclosing the algorithm, software, hardware, or computing time behind the result, the details needed to judge what it means for RSA keys in use.
Why factoring matters for RSA
An RSA public key contains a modulus, the product of two large secret primes. Anyone who can factor the modulus, finding those two primes, can recover the private key.
In Special Publication 800-131A Revision 2, published in March 2019, NIST lists RSA keys shorter than 2,048 bits as disallowed for generating digital signatures and for key transport. NIST counts keys of 2,048 bits or more as providing at least 112 bits of security strength, its measure of the work needed to break a key. At 862 bits, RSA-260 is less than half the length of that 2,048-bit minimum.
The previous factorizations
On February 28, 2020, Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann announced that they had factored RSA-250, an 829-bit number from the same list and 33 bits shorter than RSA-260.
The RSA-250 team used CADO-NFS, open-source software for the general number field sieve. It reported a total computation of roughly 2,700 core-years, measured with Intel Xeon Gold 6130 processors at 2.1 GHz as the reference. The general number field sieve is a classical algorithm, meaning it runs on conventional computers instead of quantum hardware. A core-year is the work one processor core does in a year.
In an earlier announcement, the same six researchers reported factoring RSA-240, a 795-bit challenge number, with about 900 core-years for two stages of the computation, sieving and linear algebra, on the same reference processor.
Classical and quantum factoring
In a May 2025 preprint, Google Quantum AI researcher Craig Gidney estimated that a 2,048-bit RSA integer could be factored in less than a week by a quantum computer with fewer than a million noisy physical qubits. He assumed a uniform gate error rate of 0.1%. Physical qubits are the error-prone hardware units from which error-corrected logical qubits are built.
In a November 2024 draft of its plan for moving to post-quantum cryptography, NIST proposed deprecating RSA at 112 bits of security strength after 2030 and disallowing it after 2035.
Update, November 12, 2026: In a September 9 post on Cognition’s blog, Lu wrote that the computation took “about 4,900 GPU-days” on NVIDIA GB200, GB300, and B200 GPUs. He put the cost at about $400,000 at current market prices. He wrote that Devin built a GPU lattice siever and GPU versions of other stages of the CADO-NFS pipeline, and that RSA-2048 “does not appear to be meaningfully affected by this work.” NIST’s final IR 8547, published October 27, deprecates RSA at every approved key size after 2030.
