Glonce

Cognition's Devin factors RSA-260, sets new factoring record

securityThe Glonce editorsHacker News🔥70Glonce rating70Impact65Novelty75Relevance90Surprise60Players70Credibility85
Cognition's Devin factors RSA-260, sets new factoring record

An unnamed author, writing on Cognition's blog and using the company's own compute and job scheduler, has factored RSA-260 with the help of Devin, Cognition's AI coding agent. RSA-260 is a 260-digit number made up of two roughly 130-digit prime factors, and factoring it sets a new record for the largest number ever publicly solved in the RSA Factoring Challenge, a long-running benchmark for how hard it actually is to break the RSA cryptosystem. The previous record, RSA-250, was set in February 2020. For context, real-world RSA public keys today use 2048-bit (about 617-digit) numbers, while 1024-bit (about 309-digit) RSA was deprecated back in 2013.

The author frames the project as a side effort that grew out of optimizing Cognition's job scheduler to make better use of what the post calls 'disaggregated compute,' combined with a personal hobby of factoring numbers pursued for about ten years. Work began on August 13 (the post does not give a year) at 00:11:58 Pacific time, when the author tasked Devin with building glas, a GPU replacement for las, the CPU-based lattice siever in CADO-NFS, the open-source implementation of the general number field sieve (GNFS) the project builds on. Two hours later the author raised the bar so the new siever could handle RSA-250's parameters, then went to sleep. Seven hours after that, Devin had a version that already beat the CPU siever. Over the following week, the author kept driving Devin to optimize the rest of the GNFS pipeline, which runs in three sequential stages: polynomial selection, lattice sieving, and linear system solving.

By the author's account, Devin rewrote nearly every stage of the pipeline for GPUs: a modified stage-1 polynomial selector built partly on pieces of the msieve library, the new GPU lattice siever, an optimized head process to manage the resulting workload, parallelized programs for cleaning up and merging the relations sieving produces, a new GPU implementation of the block Wiedemann algorithm used for linear system solving, and GPU-accelerated square-root extraction for turning a solution into an actual factorization. Only four CADO-NFS programs were left untouched. The author is careful to call this an engineering result rather than a mathematical one, reporting 'essentially no algorithmic advancements': the gain came from adapting lattice sieving and sparse linear system solving to a GPU's memory bandwidth, something no prior public RSA factoring record had done, since earlier records relied on CPU-only sieving.

The numbers behind the record: lattice sieving produced 8.3 billion sparse linear relations, and the full factorization took about 4,900 GPU-days, or 13.5 GPU-years, costing roughly $400,000 at current market GPU prices. Broken down by stage, polynomial selection took 643 GPU-days, which the author calls 'anomalously high' and attributes to their own inexperience running it; lattice sieving, the most expensive stage, took 3,813 GPU-days; and linear system solving took 467 GPU-days, about 7% of which made no progress due to crashes or being preempted by higher-priority jobs. None of this used dedicated compute: it ran on spare, fragmented capacity inside Cognition's GPU clusters, the odd idle node or mismatched rack slot left over when the job scheduler packs LLM training and inference workloads into 18-computer NVLink racks. The author estimates such gaps amount to only a single-digit percentage of Cognition's overall compute, and the factorization ran at no marginal cost on top of it.

On Devin's role, the author says they personally set priorities, established benchmarks, and stepped in when work went off track, while Devin 'autonomously handled measurements, cluster operations, and optimization end-to-end.' The author argues this substituted for what would likely have been a multi-month effort by a team of specialized domain experts, and describes their own understanding of the resulting code as roughly that of 'a mid-level car hobbyist' toward car components: enough to grasp the role of each piece, but not the underlying theory.

The author's central caveat concerns what this means for larger RSA keys. Because RSA-1024 (309 digits) requires only about 78 times the computation of RSA-260 under standard GNFS scaling, the author estimates hyperscalers or frontier AI labs could now factor a single RSA-1024 number for on the order of $30 million using this approach, and would not be surprised if further optimization cut that by roughly another 2 times. That RSA-1024 is insecure is not new: the author notes speculation dating to the mid-2000s that the NSA might already have had the economic capability to factor it. What actually changed, in the author's telling, is threefold: a potentially lower dollar and time cost, more parties able to attempt the work since it now needs only enough GPUs rather than specialized hardware, and the relative ease with which people outside cryptography can contribute to speeding up factoring. Crucially, the author states plainly that RSA-2048, the key size actually used in production today, remains roughly a billion times harder to factor than RSA-1024 and 'does not appear to be meaningfully affected by this work.' The broader claim the author draws from the project is that the barrier to entry for cryptanalytic work, other computational mathematics, and likely most large-scale scientific computing research is now far lower than it used to be.

Key facts

  • An unnamed author at Cognition used the company's AI coding agent Devin to factor RSA-260, a 260-digit number, setting a new record for the largest RSA Factoring Challenge number ever publicly solved and beating the RSA-250 record set in February 2020.
  • The factorization cost about $400,000 in compute, roughly 4,900 GPU-days (13.5 GPU-years), and ran on spare, otherwise-idle capacity inside Cognition's GPU clusters at no marginal cost.
  • Lattice sieving, the most expensive of GNFS's three stages at 3,813 GPU-days, produced 8.3 billion sparse linear relations; the author calls the 643 GPU-days spent on polynomial selection 'anomalously high.'
  • The author says Devin autonomously handled measurements, cluster operations and optimization end-to-end, while their own role was limited to setting priorities and benchmarks, work they say would otherwise likely have taken a specialized team months.
  • The author estimates hyperscalers could factor an RSA-1024 number for on the order of $30 million using this method, since RSA-1024 needs roughly 78 times the computation of RSA-260, but stresses RSA-2048, today's standard key size, remains roughly a billion times harder than RSA-1024 and is not meaningfully affected.

Why it matters

The headline result is a new public record: RSA-260 is now the largest number ever publicly factored in the RSA Factoring Challenge, beating the RSA-250 record set in February 2020. The more consequential claim in the post is about how it was done. An unnamed author at Cognition says Devin, the company's AI coding agent, built the entire GPU-based factoring pipeline with only light supervision: the author set priorities and benchmarks and caught work that drifted off track, while Devin 'autonomously handled measurements, cluster operations, and optimization end-to-end.' The author frames this as substituting for a multi-month effort by a team of specialized domain experts, and argues the barrier to entry for cryptanalytic work, and likely most large-scale scientific computing research, is now far lower than it used to be. Devin's GPU lattice siever also represents a real efficiency gain on its own terms, about 10 times lower cost than the previous public state of the art for factoring numbers, which the author attributes to ordinary performance engineering rather than new algorithms, exploiting GPU memory bandwidth in a way earlier CPU-only GNFS implementations did not.

Who it affects

Directly, this affects cryptography researchers and anyone tracking the practical security margins of RSA key sizes. The author estimates that hyperscalers or frontier AI labs could now factor an individual RSA-1024 (309-digit) number for on the order of $30 million at market GPU prices, since RSA-1024 requires about 78 times the computation of RSA-260 under standard GNFS scaling, and suggests moderate further optimization could cut that by roughly another 2 times. RSA-1024 has been considered insecure since it was deprecated in 2013, and the author notes speculation dating to the mid-2000s that the NSA could already factor it economically. This work does not affect anyone using RSA-2048, today's standard RSA key size: the author says it remains roughly a billion times harder to factor than RSA-1024 and is not meaningfully touched by these efficiency gains. More broadly, the post addresses researchers in computational mathematics and large-scale scientific computing, who the author argues now face a lower barrier to entry given how much of the work an AI agent like Devin can absorb.

How to use it

There is no product, price or access tier here: this is a research writeup on Cognition's own blog, and the post does not say whether the GPU-optimized GNFS code Devin built (glas, the new polynomial selector, the GPU block Wiedemann implementation and the rest) will be released or open-sourced; it notes only that the underlying CADO-NFS framework it modifies is free, open-source software. The factorization ran on Cognition's own spare compute, so nothing here is directly usable by a reader. The one transferable idea is the scheduling pattern: the author first rigged the job scheduler to fill idle single-node slots at bottom priority, then looked for a workload that could start, stop and resume freely, and found lattice sieving, which splits into billions of independent work units and is safe to interrupt at any moment. That kind of embarrassingly parallel, freely preemptible workload absorbing whatever compute a scheduler leaves unused is the part of this project that could generalize to other scientific computing problems.

How solid is it

The account comes directly from the unnamed author who ran the project, posted on Cognition's own blog with no byline. The factorization result itself is checkable in principle: the post publishes the full 260-digit number together with its two prime factors, so the core claim rests on arithmetic anyone can verify rather than on trust alone. The post does not mention any independent verification, peer review or third-party confirmation of the result or of the supporting figures, such as the GPU-day cost breakdown or the 8.3 billion relations count; those rest on the author's own account and internal tooling. The author is candid about at least one soft spot, calling the 643 GPU-days spent on polynomial selection 'anomalously high' and attributing it to their own inexperience rather than to the method. The RSA-1024 cost estimate and the further roughly 2 times speedup are explicitly framed as estimates and speculation, not results Devin actually produced.

Risks and caveats

The author's own framing is the biggest caveat: these efficiency gains have little impact on the feasibility of factoring RSA-2048-sized numbers with GNFS, so nothing here threatens the RSA key sizes actually deployed today. The RSA-1024 cost estimate, on the order of $30 million, and the further roughly 2 times cost cut the author speculates additional optimization could bring, are both explicitly hedged; RSA-1024 itself was not factored in this project, only RSA-260. The claim that the NSA might have had the economic capability to factor RSA-1024 since the mid-2000s is prior, external speculation as the author describes it, not a claim the author makes about current NSA capability. Operationally, about 7% of the linear-system-solving GPU-days made no progress, lost to crashes or preemption by higher-priority jobs, a reminder that the spare-compute, no-marginal-cost framing still involved real friction. No code release, independent replication or third-party audit of the result is mentioned anywhere in the post.

“RSA-2048 remains roughly a billion times harder than RSA-1024 and does not appear to be meaningfully affected by this work.”

— the post's author, writing on Cognition's blog