Four days ago, Anthropic engineer Stephen Weis used Claude to factor RSA-896 — a 270-digit, 896-bit number and the largest RSA challenge ever broken in public. He did it in 10 days on a fleet of up to 2,048 GPUs, most of them scavenged idle capacity. Sixteen days earlier, Cognition engineer Eric Lu used Devin to crack RSA-260, the previous record. The public factorization frontier moved 67 bits in under three weeks. If you are running RSA-1024 anywhere in your stack, now is a good time to look.
Two Records, 16 Days Apart #
On September 3, Cognition published the prime factors of RSA-260, a 260-digit composite that had stood unsolved since the RSA Factoring Challenge launched in 1991. Lu’s team built a GPU-accelerated version of CADO-NFS — the open-source general number field sieve implementation from INRIA — using Devin agents to handle porting, optimization, and parallelization across every stage of the pipeline. Total compute: roughly 4,900 GPU-days.
On September 19, Weis published the factors of RSA-896, pushing the record from 862 to 896 bits. Claude ported CADO-NFS to GPU and orchestrated the computation across up to 2,048 GPUs over 10 days — about 30 GPU-years of total compute. Weis made one thing clear: he did not improve the GNFS algorithm itself. This was GPU engineering and parallelization work, done with AI as the coding agent. That distinction matters.
AI did not invent a new way to break RSA. It removed the specialist-knowledge barrier that previously made GPU-adapting CADO-NFS too painful for all but a handful of researchers. The bar just got lower.
The RSA-1024 Problem #
RSA-2048 is not threatened. The gap between RSA-1024 and RSA-2048 is roughly a billion-fold in computational cost under the same GNFS model. A tenfold engineering improvement does not close a billionfold gap. Your production HTTPS is fine.
RSA-1024, however, is a different conversation. Based on RSA-260’s compute cost, Cognition estimated that factoring RSA-1024 at current GPU market prices would cost roughly $30 million — well within reach of nation-states and intelligence agencies. That estimate assumes the current implementation, which both Lu and Weis described as significantly suboptimal. Moderate further work could cut the cost by another factor of two or more.
RSA-1024 has had roughly 80 bits of security for years, which is why standards bodies banned it from new deployments in 2013. But theoretical weakness is different from a $30 million price tag with a working implementation. The calculus changed.
The problem is where RSA-1024 persists despite that history:
- DKIM email signing records — a surprising number of domains still use 1024-bit
- Old SSH keys that have not been rotated
- Legacy enterprise PKI and internal certificate authorities
- IoT and embedded devices with hardcoded key sizes
- VPN hardware configurations from before 2014
- JWT signing keys in older internal APIs
- TLS certificates on forgotten internal services
Audit Your Stack Now #
The audit is not complicated. Start with internet-facing services, then work inward:
openssl s_client -connect yourserver.com:443 2>/dev/null \
| openssl x509 -noout -text | grep "Public Key"
openssl x509 -in cert.pem -text -noout | grep "Public Key"
ssh-keygen -t ed25519 -C "your_email@example.com"
For migration, the priority order is: internet-facing TLS certs first, then SSH keys, then DKIM records, then internal PKI, then embedded systems — which may require hardware replacement, so start planning now. On new deployments, skip RSA entirely. ECDSA P-256 for TLS and Ed25519 for SSH give 128-bit security with smaller keys and faster operations.
The Broader Signal #
These two factorizations are not a cryptographic emergency for 2048-bit systems. But they illustrate something worth internalizing: AI coding agents have materially lowered the engineering barrier for large-scale cryptanalysis. Work that previously required deep GNFS expertise can now be approached by a competent engineer with a capable AI assistant and access to a GPU fleet.
That changes the threat model for RSA-1024 specifically. It also adds urgency to the NIST PQC migration. The final standards — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) — have been published. NSS compliance deadlines start January 2027. Inventory your cryptographic dependencies. Start testing PQC libraries. The quantum threat is still theoretical; the GPU and AI threat to RSA-1024 is not.
RSA-1024 was already indefensible on paper. Now it is indefensible in practice, at a price that real adversaries can afford. The audit should have happened years ago. If it did not, this week is the right time.