Stephen A. Weis, a member of technical staff at Anthropic, published the two prime factors of RSA-896 on September 19, 2026. RSA-896 is a 270-digit, 896-bit number from the RSA Factoring Challenge. RSA Laboratories began the challenge in 1991 to encourage research into the practical difficulty of factoring large integers and added RSA-896 to it in 2001.
Weis wrote that Claude, Anthropic’s AI model, was used to port the open-source CADO-NFS factoring software to run on graphics processing units (GPUs). CADO-NFS implements the general number field sieve (GNFS), a classical factoring algorithm that runs on conventional computers and needs no quantum hardware. He wrote that Claude also orchestrated the job as a low-priority task on up to 2,048 GPUs during idle time between regular jobs.
Weis wrote that the result “does not impact the security of deployed RSA-2048 keys” but shows that RSA-1024 keys “are vulnerable to many actors with data center-level fleets of GPUs.”
Anyone who can factor the modulus of an RSA public key, the product of two large primes, can recover the private key.
Weis wrote that he had not meaningfully improved the running time of GNFS. By his account, the computation took 10 days and about 30 GPU-years, the equivalent of one GPU working for 30 years.
Earlier factoring records
On September 3, Eric Lu of Cognition factored RSA-260, an 862-bit challenge number, using GPU versions of CADO-NFS components built with Cognition’s Devin AI agent. In a September 9 post, Lu described RSA-260 as a new record for the largest publicly solved number in the challenge. Lu put the total at about 13.5 GPU-years of spare compute.
RSA-896 is 34 bits longer than RSA-260 and was factored 16 days later. Before September, the largest factored challenge number was the 829-bit RSA-250.
Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann announced the factors of RSA-250 on February 28, 2020. They ran CADO-NFS on central processing units (CPUs) and put the computation at roughly 2,700 core-years, the equivalent of one processor core working for 2,700 years.
What can be checked
Quantum Observer multiplied the two published primes, each 135 digits and 448 bits long, and confirmed that their product equals RSA-896. It also confirmed with a standard primality test that both factors are prime.
Weis’s own posts are the only source for the run time, the GPU count, and Claude’s role. He did not name the version of Claude, describe how the work divided between him and the model, or say whether the code would be released. “More details will follow,” he wrote.
Weis’s earlier cryptanalysis
Weis earned a PhD in computer science at MIT, where Ron Rivest, a co-inventor of RSA, advised him, according to his website. Before joining Anthropic’s Secure Frameworks team, he worked at Google, Facebook, and Databricks.
On July 28, Weis posted a key-recovery attack on HAWK, a lattice-based signature scheme in NIST’s process for standardizing additional post-quantum signatures, to the agency’s pqc-forum mailing list. In a key-recovery attack, an attacker derives a signer’s private key from public information. Anthropic wrote the same day that one of its researchers had developed an attack on HAWK in work with its Claude Mythos Preview model.
The HAWK team withdrew the scheme from NIST’s process on July 29. Weis and Anthropic colleague Zygimantas Straznickas posted the attack as a preprint, a paper released before peer review, on August 3.
RSA key sizes
In SP 800-131A Rev. 2, transition guidance published in March 2019, NIST disallows RSA keys shorter than 2,048 bits for generating digital signatures and for key transport. Key transport is the use of RSA to send a secret key to another party. NIST permits keys of 1,024 to 2,047 bits only for legacy use in verifying existing signatures.
In his RSA-260 post, Lu estimated that frontier AI labs or hyperscalers, the largest cloud providers, could likely factor a 1,024-bit RSA number at “a cost on the order of $30 million per number.” RSA-1024, the 309-digit challenge number, has not been publicly factored.
Update, November 12, 2026: Weis has since expanded his post. It now says the run used up to 256 preemptible nodes of eight H100 GPUs each and took about 10.07 days. On September 20, researchers at the University of California San Diego and INRIA reported forging signatures for a 1,024-bit RSA key without factoring it, using 1,380 core-years of computation. RSA-1024 has still not been publicly factored.
