--- title: "Devin Helped Break a 35-Year-Old Cryptography Record — and This Time You Can Check the Math Yourself" date: 2026-09-18 tags: ["cognition","devin","agentic-coding","case-study","security"] categories: ["Case Studies","Industry"] summary: "Cognition engineer Eric Lu, working with multiple Devin agents, factored RSA-260 — a 260-digit number unsolved since the 1991 RSA Factoring Challenge — using a GPU-accelerated rewrite of the CADO-NFS sieving toolkit that Devin designed and operated with only periodic human steering. We independently re-multiplied and primality-tested the published factors ourselves: the claim checks out. RSA-2048 is unaffected." --- ![Devin Helped Break a 35-Year-Old Cryptography Record — and This Time You Can Check the Math Yourself](/images/cognition-devin-rsa-260-factorization.png) Most AI coding benchmarks ask you to trust the vendor. A claimed SWE-bench score, a Terminal-Bench percentage, a self-reported "beats GPT-6 Astra at a quarter of the cost" — all of it rests on taking someone's word for how the eval was run. [Cognition's RSA-260 factorization](https://cognition.com/blog/factoring-rsa-260), announced by engineer Eric Lu and detailed in a September blog post, is a rare exception: it produces two prime numbers, and anyone with a laptop and five minutes can multiply them together and check whether the answer is correct. We did. ## What actually happened RSA-260 is a 260-digit (862-bit) composite number from RSA Laboratories' 1991 Factoring Challenge — a public list of numbers designed to be hard to factor, published specifically so cryptographers could track how much computing power it actually takes to break increasingly large RSA-style keys. It had sat unfactored for 35 years, the largest number on that list still unsolved, since RSA-250 fell in February 2020. Lu's team factored it using the General Number Field Sieve, the standard algorithm for numbers this size, but built on a heavily modified, GPU-accelerated rewrite of CADO-NFS — the open-source factoring toolkit the field has run on CPU clusters for over a decade. According to Cognition's own numbers, the full run took roughly 4,900 GPU-days (about 13.5 GPU-years) spread across three weeks of wall-clock time, using spare, fragmented capacity inside Cognition's own LLM training clusters — compute that would otherwise have sat idle between training jobs. Cognition estimates the market cost at around $400,000. The division of labor is the actual story. By Lu's own account, his role was "primarily to set priorities, establish benchmarks, and recognize when work was going off-track" — checking in roughly every two hours across the project. Devin agents handled the rest: designing the GPU-adapted polynomial selection and lattice-siever code, tuning parameters, orchestrating the compute cluster, debugging failed runs, and driving the iterative optimization loop that eventually produced a siever Cognition says is roughly ten times more cost-efficient than the previous public state of the art. That's a materially different claim than "AI wrote some code for a research project" — it's closer to Devin functioning as the actual systems and performance engineer, with a human doing the executive-function work of deciding what to try next. ## We checked it ourselves Cognition published the two factors: - a 130-digit prime beginning `4397328654844826923795068...` - a 130-digit prime beginning `5028695206842569864686141...` We multiplied them. The product is a 260-digit number that matches the publicly documented RSA-260 challenge value digit-for-digit. We then ran both factors through 20 rounds of Miller-Rabin primality testing — the standard probabilistic check, at odds of a false positive below 1 in 4^20 — and both came back prime. The factorization holds up under independent verification that took a few minutes and no trust in Cognition's honesty at all. That's a genuinely different epistemic position than every self-reported benchmark table this blog has flagged as "worth rechecking once an independent leaderboard entry appears" over the past six months, from [SWE-2's numbers](/2026/09/cognition-swe-2-devin-kimi-k3/) to [Qwen3.8-Max's launch claims](/2026/08/qwen-3-8-max-launches-benchmark-table/). ## What it doesn't mean Cognition is upfront about the limits of its own result, and it's worth repeating plainly: RSA-2048, the key size actually used in TLS certificates and most production cryptography today, is roughly a billion times harder to factor than RSA-1024, and this work "does not appear to be meaningfully affected." What the result does sharpen is the RSA-1024 estimate — Cognition's extrapolation puts a hyperscaler-scale factorization of a 1024-bit key at around $30 million, a number that's been "not news" among cryptographers since the mid-2000s (RSA-1024 has been considered deprecated and insecure since well before this project), but is now backed by an actual GPU-cost data point instead of a theoretical estimate like TWIRL. ## The pattern this fits This is the third Cognition story this blog has covered in as many weeks that circles the same question: what is Devin actually good at, independent of the base model underneath it. [SWE-2, shipped September 10](/2026/09/cognition-swe-2-devin-kimi-k3/), is post-trained on Moonshot's Kimi K3 — Cognition doesn't own a frontier foundation model, and its $48 billion valuation is a bet that the orchestration and product layer matters more than owning one. RSA-260 is a data point in favor of that bet holding, at least for a narrow, well-defined, verifiable class of problem: give Devin a hard, measurable optimization target and enough compute, and it can apparently do sustained systems-engineering work across weeks with only light human steering, without needing the frontier-model crown to do it. It's also a fair, competitor-generated example of the exact thesis this blog champions about agentic coding generally — that the interesting frontier isn't a chatbot answering questions, it's an agent given a goal, tools, and enough autonomy to run for weeks and be judged on output. Anthropic's own version of that thesis runs through Claude Code's [Agent Teams](/2026/03/claude-code-agent-teams-multi-agent-orchestration/) and [Dynamic Workflows](/2026/06/multi-agent-software-development-architecture-patterns-2026/); Cognition just supplied a case study where the output is a number you can independently check rather than a benchmark score you have to trust. Credit where it's due. **Sources**: [Cognition — "Factoring RSA-260"](https://cognition.com/blog/factoring-rsa-260) (Sept 2026, primary, direct fetch); independent verification performed for this article (factor multiplication and Miller-Rabin primality testing, 20 rounds); this blog's prior coverage of [Cognition's SWE-2](/2026/09/cognition-swe-2-devin-kimi-k3/).