AI and Classical Factoring Security

Key Takeaways:

• On September 19, 2026, Anthropic’s Stephen Weis published the factorization of RSA-896, a 270-digit number, after Claude ported CADO-NFS to graphics processors and coordinated up to 2,048 of them for about 10 days and roughly 30 GPU-years. Sixteen days earlier, Cognition’s Eric Lu factored RSA-260 with Devin.
• Neither result improved the underlying algorithm. Both used the general number field sieve, the same classical method used since the 1990s, moved onto GPUs by AI coding agents.
• RSA-2048 requires about 35 billion times more work than RSA-896 under standard scaling. RSA-1024 is the exposed tier, estimated at about $30 million on market GPU pricing.
• Classical factoring and quantum computing are separate threats. The September records provide insight into GPU engineering, not quantum hardware.
• Crypto-agility, not any single algorithm swap, is the reliable defense. Only about 7 percent of enterprises have deployed quantum-safe protections across most of their certificates, per DigiCert’s July 2026 survey.

Two Records in Sixteen Days

Public integer factorization records had remained unchanged for six and a half years. On September 3, 2026, Eric Lu of Cognition published a prime factor of RSA-260, an 862-bit number from the RSA Factoring Challenge that had resisted attack since 1991. On September 19, sixteen days later, Stephen Weis of Anthropic published both prime factors of RSA-896, a 270-digit number. The public record advanced from 829 bits to 896 bits within a single month, as TechTimes documented the sequence.

The previous record was RSA-250, factored in February 2020 by a six-researcher academic team on CPUs at a cost of about 2,700 core-years, according to the 2020 paper by Boudot and colleagues. Neither September 2026 result changed the core algorithm. Both teams ported CADO-NFS, the open-source number field sieve implementation, from CPUs to GPUs using AI coding agents. Lu led Cognition’s Devin; Weis led Anthropic’s Claude. This pattern matches what we described in our SSH key management guide, where the classical GPU approach and the quantum approach follow separate timelines.

Weis’s disclosure consisted of two paragraphs and a set of numbers. As the PostQuantum technical writeup explains, he shared the compute setup but did not specify the GPU model, the Claude version, or which sieve stages were moved to GPUs. The factors themselves can be verified: each published prime has 135 digits and 448 bits, both pass primality tests, and their product matches the RSA-896 value on the public challenge list. That mathematical verification does not rely on the researcher’s report.

The Mechanics of AI-Enhanced Classical Factoring

The mathematics remained unchanged. What improved was the engineering cost of running it. Lattice sieving, the most computationally intensive stage of the number field sieve, is highly parallel and fits GPUs well in principle, but CPU-optimized sieve code depends on conditional branching and scattered memory access that GPUs handle inefficiently. For years, it was uncertain whether a GPU siever could outperform CPUs in total cost. As Lu explained in Cognition’s technical post, Devin had a working GPU lattice siever in about nine hours, then spent a week optimizing the rest of the pipeline. He reported no algorithmic improvements, describing the work as standard performance engineering.

Once that port exists, scaling to a slightly larger number is incremental, which explains why two independent teams set up GPU sieve pipelines within weeks after no record had been set for more than six years. The two runs used different AI agents and compute setups, making the result a stronger indication about the tooling than either record alone. The entire process includes polynomial selection, lattice sieving, and linear system solving, and the AI agents adjusted nearly every stage.

The compute figures are specific. Lu’s RSA-260 run used about 4,900 GPU-days, or roughly 13.5 GPU-years, costing around $400,000. Weis’s RSA-896 run took about 30 GPU-years over 10 days. Under standard number field sieve scaling, adding 34 bits of key length increases computation by about 2.6 times; 30 GPU-years compared to 13.5 matches that ratio. Each record cost roughly what the scaling curve predicts. The curve remained consistent.

What Actually Fell: RSA-1024, Not RSA-2048

The number factored is a benchmark, not a key in active use. The implication for real systems lies in the middle of the key-size range.

RSA-1024 is the vulnerable tier. Lu estimated that a hyperscaler could factor a 1,024-bit key for roughly $30 million at market GPU prices, adding that the current implementation is still suboptimal and further optimization might reduce that cost by half. Weis assessed that many organizations with data-center GPU fleets could break RSA-1024 keys, while deployed RSA-2048 keys remain secure. This is a cost barrier, not a mathematical one, and $30 million is within reach of nation-states and large cloud providers.

RSA-2048 is not part of this discussion. The jump from 896 to 2,048 bits is not a simple increase. The PostQuantum analysis estimates RSA-2048 requires about 35 billion times the work of RSA-896, roughly a trillion GPU-years, or a cost near $32 quadrillion at $3.50 per GPU-hour. No GPU fleet can close that gap, and no improvement in GPU sieving changes the exponential scaling curve. Claims that RSA-2048 will fall to classical factoring within a few years contradict this arithmetic, and no source in the September 2026 coverage makes that claim.

One exception deserves mention. The Ars Technica report covered a separate September 2026 result from researchers at the University of California San Diego and Université de Lorraine: a classical technique that forges RSA signatures without factoring the key. The SC Media summary says this reduces 1,024-bit keys to an unacceptable security level and weakens 2,048- and 4,096-bit keys. That attack targets signature schemes, especially blind signatures like those used in Privacy Pass, not the encrypt-and-decrypt path. It is a separate finding from the factorization records, and no CVE identifier had been assigned at the time of writing.

Classical Factoring Is Not the Quantum Threat

Both September records used classical algorithms on classical hardware. Neither indicates that a cryptographically relevant quantum computer exists. The two threat tracks differ fundamentally, and treating them as one leads to an incorrect migration schedule.

Classical factoring attacks succeed when the key is small enough and the attacker has sufficient GPUs; the response is to use larger keys or move away from RSA. Quantum computing, running Shor’s algorithm, would break the integer factorization and discrete logarithm problems that RSA and elliptic curve cryptography rely on, regardless of key size. The relevant resource estimate for quantum computing is Craig Gidney’s May 2025 estimate of fewer than a million noisy physical qubits running under a week, at a 0.1 percent gate error rate. No machine with those specifications exists.

The two tracks interact at the analysis level rather than the hardware level. Anthropic announced in July 2026 that an AI model found a key-recovery weakness in HAWK, a lattice-based signature candidate, and the HAWK team withdrew the scheme the following day, as Anthropic stated in its research note. That finding did not affect the finalized ML-KEM and ML-DSA standards, which rely on different mathematical foundations, but it shows AI tools now apply to the cryptanalysis that evaluates post-quantum candidates, not just to GPU engineering.

Compressed Timelines and the Agility Constraint

The pace of cryptanalytic progress is no longer slow and predictable enough for migration plans to assume. An assessment of timeline compression explains that AI systems can now absorb existing cryptanalytic literature, generate attacks from it, and extend those attacks beyond where the original research stopped, while not claiming practical breaks of properly keyed implementations. Confidence in the capability is high because the method applies broadly across published literature. Confidence in the timeline is low because historically the gap between improved theoretical attacks and operational capability has been wide.

Deployment has lagged. DigiCert’s July 2026 Quantum Readiness Outlook, which surveyed 1,001 information technology and security decision-makers across the United States, United Kingdom, and Australia, found that 87 percent of organizations were planning, testing, or implementing post-quantum initiatives while only 7 percent had deployed quantum-safe or hybrid cryptography across most of their certificates. DigiCert both commissioned that survey and sells a readiness platform, so the finding is from a vendor’s own research; the direction matches independent assessments, but the source context is worth noting.

Two categories of systems cannot rotate on a compressed timeline. Embedded and fielded systems with cryptography fixed in firmware, including industrial control equipment and communications hardware with service lives measured in decades, require physical replacement rather than a patch. Standardized protocol implementations across interoperability arrangements require coordinated agreement before any party can deploy a change, and the coordination delay is the main constraint. Those systems set the minimum speed at which an organization can respond.

Crypto-Agility Checklist: SSH, Wallets, Enterprise

Crypto-agility means the ability to swap algorithms, protocols, libraries, and implementations with minimal disruption. It is the reliable goal, because the specific algorithm that needs replacing keeps changing. The steps below are ordered by what a well-funded factoring effort or a patient attacker would target first.

• Inventory every RSA key at 1,024 bits or below and treat each as urgent. The September records put this tier within reach of organizations with data-center GPU fleets. Rotate anything at or below 1,024 bits immediately, and prioritize certificate authorities, code-signing pipelines, and long-lived signing certificates.
• Upgrade SSH to a version with post-quantum key exchange and verify it is active. Confirm the negotiated algorithm rather than assuming the default applies, and plan signature migration separately because signature keys do not carry the same store-now-decrypt-later exposure. For the full audit procedure, see our SSH key management guide.
• Classify data by confidentiality lifetime. Any record that must stay secret past 2035 is already exposed if it travels under RSA or elliptic curve protection. Long-lived archives, financial records, and government material are the priority.
• Audit wallets and address hygiene. The RSA records do not break elliptic curve keys, but the September timeline overlaps with the European Supervisory Authorities’ September 2026 warning that exposed public keys put roughly 6.9 million bitcoin at future quantum risk. See our analysis of Bitcoin public key exposure. Stop address reuse and rotate holdings away from addresses whose public keys are already visible.
• Enable hybrid key exchange on TLS. X25519MLKEM768 pairs a classical curve exchange with the NIST-standardized ML-KEM and is backward compatible, so it moves before signature retirement. For the blockchain parallel, see our look at Ethereum wallet security.
• Confirm the hardware security module roadmap. Ask each vendor for ML-KEM and ML-DSA firmware support, validation submission dates, and queue position, not a readiness badge. Some modules cannot be updated and need physical replacement, which adds procurement lead times to the schedule.
• Mark every migration deadline by authority level. Separate final standards from draft proposals and vendor commitments, so a plan never treats a proposal as a mandate.
• Benchmark post-quantum operations before cutover. Larger keys and signatures increase handshake size and compute cost. Measure on your own hardware under production-like load before committing to a date.
• Do not combine the two threat tracks into one project. Classical factoring pressure targets 1,024-bit keys now. Quantum pressure will affect all keys eventually. Keeping them separate prevents near-term work from stalling behind a long quantum timeline.

The September records broke a benchmark and lowered the engineering barrier to running classical cryptanalysis at scale. They did not break a deployed 2,048-bit key, and the quantum machine that would break such a key is not built. That combination defines the window in which migration is affordable, and organizations that treat agility as an ongoing capability rather than a one-time project will be the ones that succeed.

Related Reading

More in-depth coverage from this blog on closely related topics:

• Long-Term Data Security in Banking
• Post-Quantum Security for Ethereum Wallets
• SSH Key Management Strategies for Security
• Post-Quantum Security for Blockchain Systems
• Lessons from Solana’s Post-Quantum Migration

Sources and References

Sources cited while researching and writing this article:

• RSA-896 Cracked with Claude AI, Second Factoring Record in Sixteen Days
• 2020 paper by Boudot and colleagues
• RSA-896 Factored With Claude, 16 Days After RSA-260
• Factoring RSA-260 | Cognition
• New classical computing attack weakens RSA encryption
• Craig Gidney’s May 2025 estimate
• Anthropic stated in its research note
• Assessment: AI-Assisted Cryptanalysis Compresses Sovereign Key-Rotation …