A Devin Agent Wrote the Code That Broke RSA-260 for $400K

TL;DR

On September 3, Cognition engineer Eric Lu posted a 130-digit integer to X followed by two words: divides RSA-260. It did. That retired the largest unsolved number on the RSA Factoring Challenge list, a 260-digit (862-bit) composite that had sat there since 1991, and it beat the previous public record by ten decimal digits.

He gave no method. Six days later, on September 9, Cognition published the writeup, and the interesting part was never the number theory. The pipeline that did it, a GPU lattice siever built from scratch in three weeks, was written almost entirely by Devin, Cognition's coding agent. Total cost: about 4,900 GPU-days, roughly $400,000 at market prices.

Your keys are fine. RSA-2048 is untouched. What moved is the cost curve, and who is allowed to move it.

Six days of nothing

The announcement was a troll and a good one. A bare 130-digit number, two words, no algorithm, no hardware, no runtime. Cryptographers spent the week guessing. Scientific American ran a piece on it in which Lu offered "good old paper and pencil," and the reporting at the time concluded the effort "seemingly did not make use of any AI." Nothing concentrates a number theorist's attention like a 130-digit integer with no footnotes.

Emmanuel Thomé of INRIA, one of the six researchers who set the previous record, told the magazine that RSA-260 should run roughly three times as expensive as RSA-250 but was "certainly feasible." He was right about the difficulty and about a decade off on who would pay for it.

What actually ran

The method is the general number field sieve, the same algorithm everyone expected. The novelty is where it ran. Cognition took CADO-NFS, the open-source NFS implementation from INRIA that set the 2020 record, and replaced its CPU lattice siever las with a GPU version. Stage-1 polynomial selection was adapted from msieve. Everything ran on B200, GB200 and GB300 nodes.

The new siever is called glas. As the writeup puts it, that is "GPU las, of course." Naming remains the one part of computer science no agent has fixed.

Sieving is the part that eats the budget, and it eats it in a very specific way. NFS works by hunting for an enormous pile of numbers that factor completely into small primes, then assembling those into a linear algebra problem whose solution hands you the factors. Picture panning for gold across an entire river system: each pan is cheap and almost always empty, you need millions of hits, and nobody panning has to talk to anybody else. That last property is exactly why sieving maps onto GPUs and why 3,813 of the 4,900 GPU-days went there.

The linear algebra step is the opposite temperament: one matrix, 656,182,601 by 656,182,189, with 98,431,741,898 nonzeros at a density of 150 per row. That one does not parallelize politely, and it still only cost 467 GPU-days.

The agent did the engineering, the human did the executive function

This is the part builders should read twice. From the writeup:

Devin is a sufficiently powerful software engineer to solve a challenging problem at the intersection of computational number theory and GPU performance engineering. My role was primarily to set priorities, establish benchmarks, and recognize when work was going off-track.

And, more bluntly: "Devin needed me for executive function, talking through and sanity-checking what it was doing."

The clock started at "August 13th 0:11:58 Pacific time," when Lu aimed Devin at producing a drop-in replacement for las. Across the three-week project he ran an average of 3 concurrent Devin sessions and a maximum of 18. Sieving on RSA-260 itself began August 18 and the factor dropped September 3, with the sieving stage burning about 682,000 seconds of wall clock, just under eight days.

Note what is not being claimed. Devin did not invent an algorithm. It did GPU performance engineering against a known algorithm, at a level that normally takes a specialist a year, and it did the unglamorous 90%: measurements, cluster operations, and the optimization loop end to end. If you have wondered what the real unlock of coding agents looks like, it is not novel mathematics. It is that a person who understands the problem no longer needs to also be the person who can write a competitive CUDA kernel.

Against the 2020 record

RSA-250 fell on February 28, 2020 to Boudot, Gaudry, Guillevic, Heninger, Thomé and Zimmermann. Their announcement lists roughly 2,700 physical core-years, 2,450 of them sieving, spread across Grid'5000, the EXPLOR center at Lorraine, a PRACE allocation at Juelich, and hardware gifted by Cisco.

You cannot divide core-years by GPU-days and get anything meaningful, and the writeup does not try. It states the claim in money: the pipeline "enables factoring numbers at 10x lower cost than the previous public state of the art." Take that as a vendor number until someone reproduces it, which is now considerably easier than it was, since CADO-NFS is open and the modifications are described.

What it does and does not mean for your keys

Do not go re-issuing certificates. 862 bits is not 2048 bits, and the gap is not a gap, it is a canyon. Lu's own extrapolation puts RSA-1024 at "roughly $30M" in market GPU prices, and on RSA-2048 he is unambiguous: it "remains roughly a billion times harder than RSA-1024 and does not appear to be meaningfully affected by this work."

The practical read for builders is narrower and more boring, which is usually how it goes:

• 1024-bit RSA is now priced, not theoretical. $30M is a line item for a state and an uncomfortable one for a well-funded criminal group. If you still have 1024-bit keys anywhere, in old device firmware, legacy PKI, ancient SSH hosts, that number is your deadline.
• 2048-bit RSA is unaffected by this class of work. The thing that eventually threatens it is a cryptographically relevant quantum computer, not a better siever.
• The cost of specialist performance engineering fell. That generalizes far past cryptography, and it is the part worth internalizing.

The caveats, stated plainly

The factorization itself is trivially verifiable: multiply the two 130-digit primes and compare against the challenge number. Everything else is self-reported. The $400,000 figure, the 10x claim, and the per-stage GPU-day breakdown all come from Cognition, a company that sells the agent that did the work, in a post that is also very good marketing for that agent. None of that makes the numbers wrong. It does mean the reproduction is the interesting next step, and the code changes are described well enough that somebody will try.

Also worth keeping straight: "Devin wrote it" is not "Devin did it alone." An engineer who already understood NFS set the benchmarks, chose what to optimize, and killed the dead ends. The writeup is unusually honest about that division of labor, which is more than most agent case studies manage.

Key Takeaways

• RSA-260 (260 digits, 862 bits, on the challenge list since 1991) was factored on September 3, 2026 by Cognition engineer Eric Lu, beating the RSA-250 record that had stood since February 2020.
• The method, published September 9, is CADO-NFS with its CPU lattice siever las swapped for a new GPU siever called glas, running on B200, GB200 and GB300 nodes.
• Cost was about 4,900 GPU-days (3,813 sieving, 643 polynomial selection, 467 linear algebra), roughly $400,000 at market GPU prices, over a three-week project.
• Devin, Cognition's coding agent, wrote the siever and ran the optimization loop, at an average of 3 and a peak of 18 concurrent sessions. The human set priorities, benchmarks, and scope.
• Cognition claims 10x lower factoring cost than the prior public state of the art, and estimates RSA-1024 at roughly $30M. RSA-2048 is stated to be about a billion times harder and unaffected.
• Every figure except the factorization itself is self-reported by the company selling the agent. Treat it as a strong claim awaiting reproduction, not a settled result.

Sources: Cognition, "Factoring RSA-260", Factorization of RSA-250 announcement (CARAMBA/INRIA), Paul Zimmermann, Integer Factoring Records, Scientific American, CADO-NFS.