RSA-260 Is Broken After 35 Years. Here's What That Actually Means

A 35-Year-Old Puzzle Finally Falls

On September 3, 2026, an engineer named Eric Lu posted a single tweet containing a 130-digit number. In a quiet act that would reverberate across cryptography communities worldwide, that number was one of the two prime factors that make up RSA-260 — a 260-digit integer that had resisted factorization since 1991.

No paper. No press conference. No repository release. Just a verified prime number posted to X by someone whose handle is @penlume, belonging to a company whose headline product is Devin AI, an AI-powered software engineering platform. Elon Musk replied with the obligatory wit — “Glad I upped the character limit” — and within hours the story was everywhere.

The achievement is real. RSA-260, at roughly 862 bits, surpasses the previous record of RSA-250, cracked in 2020, and extends the frontier of classically feasible factorization by another decade of progress.

But the real story is what the crack does not imply.

What Didn’t Happen

Let’s be blunt: no quantum computer was involved.

Multiple cryptographers have confirmed that the factorization was accomplished using the General Number Field Sieve (GNFS), a classical algorithm that has been refining its approach for decades, combined with what appears to be significant GPU compute — likely drawn from the same infrastructure Cognition AI uses to train and run Devin.

This matters because the RSA-260 crack has already been interpreted by some as a harbinger of quantum supremacy over encryption. It is not.

The current standard for RSA key lengths in production systems is 2,048 bits. RSA-260 is 862 bits. The gap between them is not linear. Factorization difficulty grows super-polynomially. RSA-2048 is not 8 times harder than RSA-260. It is incomprehensibly harder. The computational resources required to factor a 2,048-bit modulus using classical methods would exceed anything currently available on Earth — something like millions of years on all existing supercomputers combined.

Quantum computers, theoretically, could change this. Shor’s algorithm, in principle, could factor large RSA moduli in polynomial time. But no quantum computer exists today that can execute Shor’s algorithm at the scale required to break RSA-2048. Estimates range from hundreds of thousands to millions of error-corrected qubits — we are decades away from that reality, if we get there at all.

The AI Angle Nobody Is Discussing Enough

The more interesting vector here is what Cognition AI’s involvement signals. GNFS has been the gold-standard factorization algorithm since the 1990s. It has not seen a fundamental algorithmic breakthrough in its core logic. What has changed is raw compute.

Cognition AI has spent years building GPU infrastructure and distributed systems optimized for AI workloads. RSA-260 factorization is, at its heart, a distributed optimization problem — sieving across massive ranges of candidate values, checking congruences, filtering smooth numbers. These are the same types of parallel, compute-intensive operations that neural network training exploits.

The inference is straightforward: the same infrastructure that powers AI development can also be repurposed for classical cryptanalytic benchmarks. This is not new in theory. What is new is the scale at which it can now be done.

If a company with Devin’s compute footprint can crack RSA-260 without a formal cryptanalysis team or a published methodology, the implication is that the barrier to achieving large-scale factorization is lower than the cryptography community assumed — not because the math has changed, but because the compute has become cheaper, faster, and more accessible.

Who Wins and Who Loses

For the cryptography community, RSA-260 is a confidence check. It confirms that our worst-case timelines for classical factorization progress are still roughly on track, and that the transition to post-quantum standards is not being outpaced by classical advances.

For Cognition AI, it is an unusual but effective marketing moment. The company did not publish a paper or file a patent. It posted a number. The result speaks for itself in an ecosystem where attention is the scarcest resource.

For companies relying on RSA-1024 or shorter keys — and there are still legacy systems out there — RSA-260 is a reminder that key length recommendations are not abstract. Those shorter keys were always vulnerable; this crack simply makes that vulnerability more tangible.

For NIST and the post-quantum migration effort, the takeaway is calibration, not alarm. The agency has already selected its first round of post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). The question now is whether RSA-260 should accelerate timelines or simply validate them. Most experts will argue the latter — but the public narrative may not be so measured.

What Comes Next

The immediate next step is verification. The cryptographic community will test Lu’s prime against the full RSA-260 composite. If it divides cleanly, the record stands. If not, the whole episode collapses into an elaborate hoax.

Longer term, RSA-260 becomes the new benchmark. The next target is almost certainly RSA-270 or beyond. As compute continues to improve — and it will — the interval between records will shorten. The mathematics behind GNFS is stable. The hardware driving it is not.

For everyone managing encryption today, the practical lesson is the same one issued after every major factorization milestone: upgrade your key lengths, migrate toward post-quantum algorithms, and stop treating RSA-2048 as immortal. It is not. It is simply far enough away that the clock has not yet started ticking audibly.

The RSA factoring challenge began in 1991 as a way to measure progress. RSA-260 is just the latest proof that progress keeps coming — in forms that sometimes look nothing like what the original challengers imagined.