A Coding Agent Factored RSA-260 and Broke a 35-Year Record

On September 3, Eric Lu, an engineer at Cognition, posted a 130-digit prime — one half of RSA-260, the 260-digit, 862-bit semiprime that had stood unfactored since the 1991 RSA Factoring Challenge.

It displaces RSA-250 (829 bits, factored in 2020) as the largest number ever factored with a general-purpose algorithm. Lu initially disclosed nothing about method, software, hardware or runtime. On September 9, he published a full account through Cognition.

The method was the General Number Field Sieve, running on a heavily modified, GPU-accelerated version of CADO-NFS, totalling roughly 4,900 GPU-days. The modifications were developed and operated with multiple Devin agents — Cognition's software engineering agent.

That last sentence is the story.

What was actually hard here

It is worth being precise about what did and did not happen, because cryptography records attract bad headlines.

RSA is not broken. RSA-260 is 862 bits. Production RSA keys are 2048 or 4096 bits, and the difficulty of GNFS grows sub-exponentially but steeply enough that 2048-bit factorization remains far outside reach of any publicly known classical effort. Nobody's TLS certificate is in danger this week.

What happened is a computational engineering achievement. GNFS has been the best known classical factoring algorithm for three decades. Records advance not because the mathematics improves but because someone does the enormous, unglamorous work of making the implementation faster and marshalling the hardware to run it.

CADO-NFS is the standard open-source implementation, and it is CPU-oriented. Porting the sieving stage to GPUs is a known-desirable, rarely-completed project: the memory access patterns are irregular, the algorithm is full of branch-heavy number theory that maps poorly to SIMD execution, and the linear algebra stage that follows has entirely different performance characteristics. It is exactly the kind of work that is too large for a side project and too unrewarding for a funded team.

4,900 GPU-days is the compute. The modified CADO-NFS is the contribution.

Why "operated with Devin agents" is the claim to examine

This is one of the first high-profile results where an AI coding agent is credited not as an assistant but as the mechanism that produced and ran the artifact.

The distinction matters. Plenty of engineers use coding agents to write boilerplate faster. What Cognition describes is different in shape: a heavily modified fork of a complex scientific codebase, developed and operated with multiple agents over a long-running computation.

That word — operated — is the interesting one. A 4,900 GPU-day computation is not a single job. It is a months-long campaign of parameter selection, polynomial selection, sieving across a distributed fleet, monitoring for stalls and bad data, restarting failed shards, and eventually the matrix step. It is a sustained operational load, and it is precisely the kind of work that does not require brilliance so much as tireless attention to a large number of boring failure modes.

Agents are unusually well-suited to that. The capability being demonstrated is not that a model invented a new sieve. It is that an agent fleet can carry a months-long, high-stakes computational campaign that a human team would have found tedious enough to never start.

The credibility sequence

The six days between the post and the disclosure are worth noting, because they show a functioning verification norm.

Lu published the factor first. That is the correct primitive: a 130-digit prime factor of RSA-260 is trivially verifiable by anyone — multiply the two halves, check against the published challenge number. It requires no trust in the claimant, no reproduction of the computation, and no access to the code.

Only afterward did the method arrive. In a field where AI-assisted results are increasingly announced with more narrative than evidence, the ordering matters: an unforgeable artifact first, the story second. Whatever role the agents played, the factorization itself is not in question.

What it implies

The immediate read for cryptography is modest and should stay modest. The record moved from 829 bits to 862 bits. The trend line for classical factoring records has been shallow for years and this does not bend it. The long-term threat to RSA remains quantum, not GPU throughput, and the migration to post-quantum algorithms proceeds on its own timeline.

The read for software is larger. A significant class of valuable work is blocked not by difficulty but by tedium — optimizing legacy scientific code, porting numerical kernels to new hardware, operating long-running computational campaigns, exhausting the parameter space of an established method. These are problems where the payoff is real and the labor is unappealing, so they sit undone for decades.

That is the category RSA-260 belonged to. The algorithm was published in the 1990s. The GPU hardware has existed for fifteen years. The port was always possible. It just was not worth anyone's year.

The demonstration is that it is now worth somebody's agent fleet. Whatever else is true about coding agents, the boring-but-valuable backlog of computational science has just become considerably more reachable — and the first thing anyone did with that was go knock over a 35-year-old record.