Cognition announced on September 9 that its researcher Eric Lu used the company's coding agent Devin to factor RSA-260, now the largest publicly known record in the RSA Factoring Challenge. The previous record, RSA-250, stood since February 2020 — a gap of six and a half years.
RSA-260 is a 260-digit decimal number split into two 130-digit primes. The algorithm itself isn't new — the General Number Field Sieve (GNFS) has been the standard approach to factoring large integers since the 1990s. What changed was the implementation: the whole pipeline moved from CPU clusters to GPUs.
How the 4,900 GPU-days were spent
Cognition's breakdown: 643 GPU-days for polynomial selection, 3,813 GPU-days for lattice sieving, and 467 GPU-days for solving the linear system. Sieving alone ate more than three-quarters of the compute, consistent with GNFS's usual profile.
The key piece of work is a GPU lattice sieve called glas, rewritten in CUDA, paired with a modified CADO-NFS and a GPU-optimized version of the block Wiedemann algorithm. Cognition says this implementation cut the per-unit cost of sieving by roughly an order of magnitude.
CADO-NFS is the same open-source software the French team used to factor RSA-250 in 2020. Same codebase, different hardware backend — and six years' worth of difference shows up in those two sets of numbers.
What Devin did here is engineering work, not mathematical discovery: code optimization, parameter tuning, cluster management. Cognition describes it in its writeup as "a software engineer good enough to work the problems that live at the intersection of computational number theory and GPU performance engineering."
The human input is in the public numbers too: 233 sessions, 82,702 words of guidance. That works out to a bit over 300 words per session on average — about the length of a code-review comment. This wasn't unattended work; it was one person steering a tool that could work continuously, flattening engineering that used to take a coordinated team months into three weeks.
What the extrapolation looks like
Cognition also offered two extrapolations, both labeled as rough estimates at current GPU prices: RSA-1024 is about 78 times harder than RSA-260, at a cost of roughly $30 million; RSA-2048 is 9.12 trillion times harder, priced at 3.77×10^16 dollars.
The first number is worth pausing on. $30 million is a sum a nation-state can afford, and so can a large enterprise. RSA-1024 has long been deprecated in standard practice, but that key length still lingers in embedded devices, old firmware signing, and a handful of unmaintained certificate chains. The roughly billion-fold gap between the two numbers is the entire reason 2048-bit still holds up today.
Stretched across the record's history: the 1999 factoring of RSA-155 was publicly estimated at about 8,000 MIPS-years; RSA-768 at the end of 2009 worked out to roughly 2,000 years on a single 2.2GHz Opteron core; RSA-250 in 2020 was 2,700 core-years; this time it's 13.5 GPU-years. The first three jumps came mainly from Moore's Law and algorithm tuning, roughly one tier per decade. This time, a hardware generation shift and the question of "who writes the CUDA code" landed on top of each other.
What's still unanswered
Cognition's announcement doesn't say whether the paper and code will be fully released, or whether glas will be open-sourced. No independent third party has reproduced the computation yet — RSA-250 was cross-validated by multiple teams' sieving parameters back in 2020; this result currently comes from a single party's data.
The factorization itself is easy to verify — multiply the two primes back together. What's hard to verify is the cost accounting: what GPU model the 4,900 GPU-days ran on, at what unit price, and whether failed attempts were counted. The announcement doesn't break any of that down. What the $400,000 figure means for security assessments depends on those details.
Sources: Cognition's official technical blog, the RSA-250 factorization announcement on caramba.loria.fr, CocoLoop; GPU-day and core-year figures are quoted as given in each respective announcement, without unified conversion.