What Is RSA-896 and Its Security Implications
Key Takeaways:
- On September 19, 2026, Stephen A. Weis factored RSA-896, the 896-bit, 270-decimal-digit challenge number, with help from Anthropic’s Claude model, moving the public factoring record from 862 to 896 bits in 16 days.
- No new mathematics was involved: the run used the classical general number field sieve (GNFS) and CADO-NFS, with AI handling the GPU port and orchestration rather than finding a shortcut.
- Deployed RSA-2048 keys are not at risk from this record. Factoring difficulty grows super-polynomially with key length, and the gap between 896 and 2,048 bits is many orders of magnitude.
- The operational signal is real: the cost of attacking undersized keys keeps falling, and NIST’s deprecate-by-2030 timeline is closer than most migration schedules assume.
The Breakthrough: RSA-896 Falls in 16 Days
On September 19, 2026, researcher Stephen A. Weis factored RSA-896, the 896-bit challenge semiprime that runs to 270 decimal digits. His own write-up at saweis.net states that RSA-896 “is RSA challenge number I factored with Claude on September 19, 2026,” and publishes both prime factors so anyone can multiply them back to the original number and confirm the result. Each factor is 448 bits, roughly 135 decimal digits.
The date matters more than the bit count. The prior public record was set less than three weeks earlier. On September 3, 2026, Eric Lu of Cognition factored RSA-260, the 862-bit challenge number, using a swarm of Devin agents, as Cryptobriefing reported. That compressed the frontier from 829 bits in 2020 to 896 bits in a matter of days rather than years.
This is a records chase, not a prize run. The RSA Factoring Challenge ran from 1991 to 2007, and according to that same report, the $75,000 prize that once accompanied RSA-896 was retracted long ago. Weis and Lu were after the record itself, not the money.
What Claude Actually Contributed
The method was not new. Both 2026 records relied on the general number field sieve, the classical algorithm that has anchored large-number factoring since the early 1990s. The open-source implementation is CADO-NFS, and earlier records were set with it. What changed was the engineering around the algorithm, not the algorithm itself.
According to OfficeChai’s account of Weis’s announcement, Claude ported CADO-NFS to run on GPUs and then managed a fleet of them, drawing on idle capacity. Weis reports the run used up to 2,048 GPUs at once over roughly 10 days, for about 30 GPU-years of total computing. A GPU-year is one GPU running flat out for a year, so spreading 30 of them across thousands of machines is what let the job finish in ten days rather than decades.
Lu’s RSA-260 run followed the same template at smaller scale: a heavily modified, GPU-accelerated CADO-NFS operated by Devin agents, consuming roughly 4,900 GPU-days at an estimated cost near $400,000, per OfficeChai. Both figures are self-reported by the researchers and neither has been independently reproduced, so treat them as claims rather than measured benchmarks.
The reusable lesson is about workflow, not cryptanalysis. Adapting a complex, highly tuned CPU codebase to GPUs and then managing thousands of chips across scavenged capacity is the kind of engineering that normally takes a specialist team a long time. That is the part AI systems are now doing, and it is why the record pace increased.
Comparing Key Sizes: 896, 1024, and 2048
Weis was explicit about the limits, and they deserve repeating because headlines routinely drop them. There is no new math here. Claude found no shortcut and no new factoring algorithm. The problem remains hard, and the cost of factoring climbs steeply as numbers grow.
That climb is super-polynomial but sub-exponential in the size of the input, per the GNFS complexity analysis. It is not a simple doubling per bit, but the practical effect is steep: keys that are a few hundred bits longer are drastically harder, and the gap between 896 and 2,048 bits is many orders of magnitude. That is why this record does not threaten deployed RSA-2048 keys.
Where the result does carry weight is in the wider set of keys below the modern floor. NIST has recommended since 2013 that RSA keys be at least 2,048 bits, a position Microsoft restated when it began deprecating 1024-bit RSA keys in Windows, noting those keys carry roughly 80 bits of strength while 2,048-bit keys carry roughly 112.
| Key size | Strength / status | Action |
|---|---|---|
| RSA-896 | Factored September 19, 2026 (record) | Never acceptable for production. Below the modern floor. |
| RSA-1024 | Approx 80 bits of strength; deprecated by NIST since 2013; Microsoft deprecating in Windows | Remove. |
| RSA-2048 | Approx 112 bits of strength; current NIST minimum | Keep for now; plan post-quantum migration. |
| RSA-3072 / 4096 | Higher margins for long-lived keys | Use for roots, CAs, and multi-year validity. |
| Post-quantum (ML-KEM, ML-DSA) | NIST-approved; deprecate vulnerable algorithms by 2030, remove by 2035 | Inventories and pilots should be underway. |
The public record ladder shows the shape of the climb. RSA-250 at 829 bits was factored in 2020 with classical methods and took about 2,700 CPU-years, per OfficeChai. The 2026 runs leapfrog six years of incremental progress in weeks, but they also consumed enormous shared compute. The Wikipedia RSA numbers table tracks the full sequence of solved challenge numbers.
Quantum and AI Pressure on RSA-2048
Two distinct pressures now sit on RSA-2048, and mixing them up is a common mistake. The classical record ladder is one: AI-assisted engineering keeps lowering the time and cost of running the sieve. Quantum computing is the other, and it is a different kind of threat because Shor’s algorithm would not need the sieve at all.
Google Quantum AI researchers reported in a May 2025 paper that a machine with roughly one million noisy qubits running for about a week could theoretically factor RSA-2048, about 20 times fewer qubits than a 2019 estimate, as CSO Online covered. That estimate assumes error-corrected hardware that does not exist at scale, so it moves the planning horizon rather than the attack capability. The RSA-896 record does not shorten it at all, because no quantum computer was involved in that factorization.
For security engineers, the correct reading is neither panic nor complacency. The RSA-896 result is an example of engineering muscle, not a security breach, and Weis states plainly that it poses no new threat to deployed cryptographic keys. The operational signal is that the cost of attacking undersized keys keeps falling while the cost of migrating keeps being deferred.
Practical Implications for Deployed Systems
The practical guidance has not changed, and it is important to state it precisely because the news cycle invites overreaction. Do not treat the RSA-896 record as a trigger to emergency-rotate 2,048-bit keys. Treat it as a reason to finish the inventory you have been postponing.
Organizations running systems that depend on RSA below 2,048 bits have concrete work to do. Legacy systems, embedded hardware, and older TLS configurations sometimes still use 1024-bit keys, a length flagged as insufficient years ago. The RSA-896 result adds urgency to those long-standing recommendations without changing the fundamental security analysis for properly configured modern systems.
Long-lived keys deserve separate attention. Roots, certificate authorities, and anything embedded in a hardware security module or designed for multi-year use create migration hurdles that short-lived keys do not, because they cannot be rotated quickly. Those are the keys where a post-quantum path should already be documented.
Detecting Weak Keys in Your Own Infrastructure
You cannot fix what you have not inventoried. The detection problem comes first: find every RSA key and certificate in your estate, then rank by length and validity period.
Start with the obvious surfaces. TLS endpoints and their certificates, SSH host keys, code-signing keys, VPN and IPsec material, and anything in an HSM or hardware token. Embedded devices are the common blind spot, because printers, cameras, and network appliances frequently ship with 1024-bit RSA that cannot be trivially rotated.
Practical detection steps you can run this week:
- Enumerate live certificates and extract key sizes from your public endpoints, then flag anything below 2,048 bits.
- Scan internal services and inventory SSH host keys by algorithm and length.
- Check device firmware inventories for hard-coded or non-rotatable keys, which often cannot be upgraded at all.
- Enable logging on Windows endpoints to catch devices attempting to authenticate with 1024-bit keys before enforcement lands, as Microsoft’s deprecation guidance recommends.
- Track key validity periods separately from key length, since a 2,048-bit key with a 20-year lifetime is a different risk than one with a two-year lifetime.
Note that key-length scanners report what a service presents, not what it can negotiate, and they miss symmetric fallbacks and legacy protocols entirely. Treat scan output as a starting inventory, not a complete cryptographic asset map.
Audit Checklist
Use this to audit your own systems against the RSA-896 record and the wider key-length guidance:
- Inventory every RSA key and certificate, including embedded devices, HSMs, and code-signing keys.
- Flag and schedule removal of any RSA key below 2,048 bits, especially the 1024-bit keys NIST has discouraged since 2013.
- Confirm long-lived keys (roots, CAs, multi-year signatures) use 3,072 or 4,096 bits or are on a documented post-quantum path.
- Build a cryptographic asset map, not just a certificate list, so you know which keys can be rotated and which are locked in hardware.
- Start post-quantum pilots now, tracking NIST’s deprecate-by-2030 and remove-by-2035 milestones against your own migration lead times.
- Enable pre-enforcement logging for weak-key authentication attempts so you find affected devices before enforcement breaks them.
- Do not treat the RSA-896 record as a trigger to emergency-rotate 2,048-bit keys; treat it as a reason to finish the inventory you have been postponing.
Related Reading
More in-depth coverage from this blog on closely related topics:
- What Is AI Force and How Does It Work?
- How GPT-6 Solved WWI German Radio Cipher
- How GPT-6 Astra Solved Historical Ciphers
- Understanding x86 Emulation Problems
- How to Hack OpenAI Security Vulnerabilities
Sources and References
Sources cited while researching and writing this article:
Rafael
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...