Devin agents factor RSA-260 in new record, cutting factoring costs tenfold

Cognition, the company behind the Devin AI coding agent, has factored RSA-260, claiming a new record for the largest number from the RSA Factoring Challenge ever publicly broken. In a post on the company's blog, researcher Eric Lu says the 260-digit semiprime was cracked by a GPU implementation of the general number field sieve (GNFS) that Devin agents built and ran largely on their own, at an estimated $400,000 in GPU time — roughly ten times less than the previous public state of the art. The prior record, RSA-250, had stood since February 2020.

No quantum tricks, just faster sieving

Lu is explicit that nothing exotic happened: Cognition has not secretly built a multi-thousand-qubit quantum computer, and the work contains essentially no algorithmic advances. The team took CADO-NFS, the open-source number field sieve package, and heavily reworked it so that its most expensive stage — lattice sieving — runs on GPUs instead of CPUs. Sieving had resisted GPU porting for years because tuned CPU code leans on heavy branching and irregular memory access patterns, and few people sit at the intersection of kernel engineering and number theory. According to Lu, adapting the code mostly came down to disciplined performance work that takes advantage of the memory hardware modern GPUs offer.

Lu kicked the project off on August 13 with a single prompt asking Devin for a drop-in GPU replacement for CADO-NFS's CPU siever. From there the agents handled measurement, cluster operations and optimisation end to end, while Lu describes his own role as setting priorities, establishing benchmarks and catching work that went off track. He estimates the setup substituted for what would have been months of effort by a team of highly specialised experts.

Run on compute nobody wanted

The factorization consumed about 4,900 GPU-days, or 13.5 GPU-years: 643 days on polynomial selection (anomalously high, which Lu blames on operator error), 3,813 days sieving, and 467 days solving the sparse linear system, of which roughly 7% was lost to crashes and preemption by higher-priority jobs.

Crucially, it cost the company little in practice. LLM clusters built around NVL72 racks leave fragmented capacity — an idle node here, failover headroom there — adding up to a single-digit percentage of total compute. Lu wired the job scheduler to fill those gaps with bottom-priority, instantly preemptible single-node jobs, and lattice sieving fits that profile perfectly: it splits into billions of small independent work units and makes progress one node at a time. The record attempt therefore ran at essentially no marginal cost, as a side effect of tuning the scheduler for disaggregated compute.

RSA-1024 gets closer; RSA-2048 does not

Under standard GNFS scaling, 1024-bit RSA (~309 digits) is only about 78 times more work than RSA-260, which Lu prices at roughly $30 million per number at market GPU rates — and possibly half that with further optimisation, since he considers the current implementation clearly suboptimal. That 1024-bit keys are within reach of well-resourced adversaries is old news: 1024-bit RSA was deprecated in 2013, and mid-2000s designs such as TWIRL and Bernstein's circuit ideas assumed intelligence agencies could already manage it economically. What shifts, per Lu, is who can do it — commodity GPUs rather than custom hardware — along with the cost, and the fact that non-cryptographers can now credibly work on speeding up factoring.

Today's standard 2048-bit keys (~617 digits) remain roughly a billion times harder than 1024-bit ones and, according to Lu, are not meaningfully affected by this work.

Why it matters

The record is a two-for-one signal. For cryptography, it shows the cost curve for breaking classic RSA being pushed down not by new mathematics or quantum machines but by cheap parallel hardware and smarter scheduling — which quietly widens the set of actors who could attack legacy keys still sitting in old systems. For software, it is one of the clearest public demonstrations yet that autonomous agents can operate at expert level on a genuinely hard systems problem, translating a research objective into kernel code, cluster operations and measurement with a human mostly steering. Lu's own conclusion is that the barrier to entry for cryptanalysis and large-scale computational research has dropped sharply — and that anyone with GPUs and an ambitious problem should take note.