AI-Assisted Math Tools Break Two RSA Factoring Records in 16 Days, Still Nowhere Near Breaking Modern Encryption

Two cryptography records fell in the space of 16 days this month, and both had an AI model looking over the researcher's shoulder.

On September 3, 2026, Cognition engineer Eric Lu posted a 130-digit number on X with a single line: it divides RSA-260. RSA-260 is an 862-bit, 260-decimal-digit semiprime from the original 1991 RSA Factoring Challenge, a list of hard math problems RSA Laboratories published to test the real-world durability of RSA encryption. Nobody had factored it in 35 years. Within minutes, according to lilting.ch, the RSA numbers page on Wikipedia was already updated to reflect the new record.

On September 19, 2026, researcher Stephen A. Weis went further, factoring RSA-896, a 270-decimal-digit semiprime, according to Crypto Briefing. That pushed the public factoring record from 862 bits to 896 bits in just over two weeks.

Both researchers used the general number field sieve, the same classical algorithm cryptographers have used since the early 1990s. No quantum computer was involved in either case. What changed was the assist. Crypto Briefing reports Weis used Anthropic's Claude model, while Lu reportedly used Devin, the AI agent built by his own employer, Cognition.

What each record actually cost

Lu's RSA-260 factorization wasn't cheap. A week after his announcement, he published details estimating the job took about 4,900 GPU-days, or 13.5 GPU-years, at a compute cost of roughly $400,000, according to johndcook. That's still a fraction of what the previous record required. RSA-250, an 829-bit number factored on February 28, 2020, by a six-person team including Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé and Paul Zimmermann using the open-source CADO-NFS software, took roughly 2,700 CPU core-years, per lilting.ch.

Compute cost for Weis's RSA-896 has not been published anywhere in current reporting. Given the record jumped from 862 to 896 bits in 16 days, the pace of progress appears to be compressing what used to be multi-year academic projects into weeks. What isn't clear yet is whether that speedup came primarily from smarter AI-guided parameter tuning, brute compute spending, or some combination the researchers haven't detailed.

Was AI actually the reason, or just the headline?

Scientific American's Peter Hall, writing the day after Lu's September 3 announcement, noted conflicting reports about whether Devin was actually used, and pointed out Lu had jokingly claimed the factorization involved nothing more than "good old paper and pencil." Hall's piece treated the AI angle as unconfirmed and Lu's own explanation as likely a joke, writing that the real method was probably undisclosed at the time.

ExplainX.ai's roundup, published around the same time, went further and flatly labeled Lu's methodology "undisclosed at time of writing," while shooting down a viral rumor that he'd simply tested random primes for seven months, calling that claim arithmetically impossible.

Crypto Briefing's later account, published September 19, states as settled fact that Lu used Devin AI agents. Scientific American reported this as uncertain on September 4, while Crypto Briefing reported it as confirmed two weeks later. Neither Lu nor Cognition has published a methodology paper laying out exactly how much of the work Devin performed versus standard GNFS tooling run by humans.

The part that matters for your bank account

The legitimate worry here is real: if AI tools are compressing factoring timelines this fast, does that mean RSA-2048, the encryption standard actually protecting online banking, email and VPNs, is closer to being broken than people think?

The math says no, not remotely. According to johndcook's calculations, an 862-bit RSA key carries a security level of about 74 bits, while the 2048-bit minimum now recommended carries a security level of roughly 107 bits. Because security levels are logarithmic, each additional bit of security doubles the required effort. Breaking a 2048-bit key would take on the order of 10 billion times more computational effort than factoring RSA-260 did. ExplainX.ai's own fact-check bluntly states it: "Is 2048-bit RSA broken? No. Not close. Not directionally close."

That said, the trend line is worth watching rather than dismissing. Going from RSA-250 (829 bits, 2020) to RSA-896 (896 bits, 2026) is a bigger jump than the six years between them might suggest, and it happened with two different AI systems in the same month. Crypto Briefing's recommendation stands on its own merits regardless of the AI debate: any organization still running RSA keys below 2048 bits, especially in legacy or embedded hardware, should treat these records as a prompt to check and upgrade, not as proof of imminent danger.

What remains unresolved is whether Weis or Cognition will publish a technical writeup detailing exactly how much of the RSA-896 and RSA-260 work the AI models performed versus standard sieve software run by human researchers. Until that's public, the honest answer to how much AI actually sped this up is partially confirmed and partially still a matter of dueling claims from the people who did the work.