Cognition Engineer Eric Lu Factors Record RSA-260 Number, Won't Explain How

Eric Lu, an engineer at the AI startup Cognition, posted a 130-digit number on X early Thursday, September 3, 2026, with a simple claim attached: it divides RSA-260.

That's it. No paper. No methodology. Just a number and two words.

The internet lost its mind anyway, because RSA-260 isn't some random string. It's part of the RSA Factoring Challenge, a list RSA Laboratories published in 1991 to test how hard it is to break down the huge semiprime numbers that underpin RSA encryption, according to ExplainX.ai. RSA-260 had sat unfactored for 35 years. The previous record on that list, RSA-250, fell on February 28, 2020, after roughly 2,700 CPU core-years of computation using the number field sieve method, ExplainX reported.

The claim checks out

Anyone can verify Lu's number in about ten seconds. Multiply his 130-digit factor by the RSA-260 modulus, divide, and see if it comes out even. ExplainX did exactly that and confirmed the factorization is real. Scientific American noted the same thing: cracking these numbers is brutally hard, but checking someone else's answer is trivial.

What's not confirmed is how Lu did it. He offered what Scientific American called "a dubious claim, perhaps made in jest," that he used nothing more than "good old paper and pencil." Neither Lu nor Cognition responded to Scientific American's request for comment.

Scientific American speculated Lu's process might have amounted to randomly sampling primes and dividing them into RSA-260 one by one until something worked. ExplainX explicitly rules that theory out, labeling the circulating claim that Lu "tested random primes for seven months" as "arithmetically impossible." Two outlets covering the same event land on opposite sides of the most basic question here: was this brute force, or something else entirely. As of this writing, nobody outside Lu and Cognition knows.

Adding to the confusion, Scientific American noted "conflicting reports" about whether Devin, the AI coding agent Cognition builds, played any role. If an AI system quietly helped crack a 35-year-old math challenge, that's a very different story than one guy with a pencil.

Not a quantum computer, and not Bitcoin's doomsday

While speculation spread online that this was some secret quantum breakthrough, cryptographers shut that down fast. Charles Guillemet, chief technology officer at hardware wallet maker Ledger, responded directly to the post, saying the factorization "has nothing to do with quantum computers," according to ABABNews. RSA-260 was cracked with classical computational number theory, the same family of techniques used on RSA-250 in 2020, not Shor's algorithm running on quantum hardware.

Guillemet also pushed back on framing that treated the RSA result as a threat to Bitcoin. Bitcoin uses a different cryptographic scheme, ECDSA, not RSA, and Guillemet called claims tying the two together "inherently flawed," ABABNews reported.

That said, Guillemet flagged a separate and real trend: in March 2026, Google Quantum AI announced it had cut the estimated logical qubit requirement for breaking 256-bit elliptic curve cryptography to around 1,200 qubits and roughly 90 million Toffoli gates, though the company released only zero-knowledge proofs without disclosing its actual circuits, according to ABABNews. Open-source researchers reportedly used that verification tool as a reward signal to reproduce and further shrink the resource estimates within days. None of that means a quantum computer capable of running the attack exists today. It means the theoretical bar keeps dropping.

What this actually means for your encryption

Modern RSA keys are nowhere near RSA-260's size, and lavx.hu News laid out the math on why that gap matters. An 862-bit RSA key like RSA-260 offers an estimated security strength around 74 bits. A properly configured 2,048-bit RSA key, the current baseline standard, sits closer to 107 to 112 bits depending on the estimation model. Since every additional bit of security doubles the computational cost of an attack, a 2,048-bit key demands tens of billions of times more work than what it took to crack RSA-260.

The practical takeaway, according to lavx.hu, is narrow: retire anything still running RSA below 2,048 bits, because it no longer has a real safety margin. Nothing about this event compromises properly sized modern encryption.

The longer-term push is already underway. NIST's roadmap calls for phasing out older asymmetric encryption systems by 2030 and banning them outright by 2035, according to ABABNews. Ledger has added experimental support for NIST's post-quantum standards, ML-KEM (FIPS 203) and ML-DSA (FIPS 204), into its software development kit. But Ledger's own Donjon Labs found that a non-invasive side-channel attack using about 400 electromagnetic traces could pull the key from an unprotected reference implementation of ML-KEM, proving that adopting a post-quantum standard on paper doesn't automatically mean it's deployed securely in hardware.

The unresolved question sits with Lu and Cognition. Neither has released a paper, a methodology, or so much as a follow-up post explaining the technique behind a 35-year-old record. Until they do, the cryptography community is left verifying the answer without understanding the math that produced it.