Most AI coding benchmarks ask you to trust the vendor. A claimed SWE-bench score, a Terminal-Bench percentage, a self-reported “beats GPT-6 Astra at a quarter of the cost” — all of it rests on taking someone’s word for how the eval was run. Cognition’s RSA-260 factorization, announced by engineer Eric Lu and detailed in a September blog post, is a rare exception: it produces two prime numbers, and anyone with a laptop and five minutes can multiply them together and check whether the answer is correct. We did.
What actually happened#
RSA-260 is a 260-digit (862-bit) composite number from RSA Laboratories’ 1991 Factoring Challenge — a public list of numbers designed to be hard to factor, published specifically so cryptographers could track how much computing power it actually takes to break increasingly large RSA-style keys. It had sat unfactored for 35 years, the largest number on that list still unsolved, since RSA-250 fell in February 2020.
Lu’s team factored it using the General Number Field Sieve, the standard algorithm for numbers this size, but built on a heavily modified, GPU-accelerated rewrite of CADO-NFS — the open-source factoring toolkit the field has run on CPU clusters for over a decade. According to Cognition’s own numbers, the full run took roughly 4,900 GPU-days (about 13.5 GPU-years) spread across three weeks of wall-clock time, using spare, fragmented capacity inside Cognition’s own LLM training clusters — compute that would otherwise have sat idle between training jobs. Cognition estimates the market cost at around $400,000.
The division of labor is the actual story. By Lu’s own account, his role was “primarily to set priorities, establish benchmarks, and recognize when work was going off-track” — checking in roughly every two hours across the project. Devin agents handled the rest: designing the GPU-adapted polynomial selection and lattice-siever code, tuning parameters, orchestrating the compute cluster, debugging failed runs, and driving the iterative optimization loop that eventually produced a siever Cognition says is roughly ten times more cost-efficient than the previous public state of the art. That’s a materially different claim than “AI wrote some code for a research project” — it’s closer to Devin functioning as the actual systems and performance engineer, with a human doing the executive-function work of deciding what to try next.
We checked it ourselves#
Cognition published the two factors:
- a 130-digit prime beginning
4397328654844826923795068... - a 130-digit prime beginning
5028695206842569864686141...
We multiplied them. The product is a 260-digit number that matches the publicly documented RSA-260 challenge value digit-for-digit. We then ran both factors through 20 rounds of Miller-Rabin primality testing — the standard probabilistic check, at odds of a false positive below 1 in 4^20 — and both came back prime. The factorization holds up under independent verification that took a few minutes and no trust in Cognition’s honesty at all. That’s a genuinely different epistemic position than every self-reported benchmark table this blog has flagged as “worth rechecking once an independent leaderboard entry appears” over the past six months, from SWE-2’s numbers to Qwen3.8-Max’s launch claims.
What it doesn’t mean#
Cognition is upfront about the limits of its own result, and it’s worth repeating plainly: RSA-2048, the key size actually used in TLS certificates and most production cryptography today, is roughly a billion times harder to factor than RSA-1024, and this work “does not appear to be meaningfully affected.” What the result does sharpen is the RSA-1024 estimate — Cognition’s extrapolation puts a hyperscaler-scale factorization of a 1024-bit key at around $30 million, a number that’s been “not news” among cryptographers since the mid-2000s (RSA-1024 has been considered deprecated and insecure since well before this project), but is now backed by an actual GPU-cost data point instead of a theoretical estimate like TWIRL.
The pattern this fits#
This is the third Cognition story this blog has covered in as many weeks that circles the same question: what is Devin actually good at, independent of the base model underneath it. SWE-2, shipped September 10, is post-trained on Moonshot’s Kimi K3 — Cognition doesn’t own a frontier foundation model, and its $48 billion valuation is a bet that the orchestration and product layer matters more than owning one. RSA-260 is a data point in favor of that bet holding, at least for a narrow, well-defined, verifiable class of problem: give Devin a hard, measurable optimization target and enough compute, and it can apparently do sustained systems-engineering work across weeks with only light human steering, without needing the frontier-model crown to do it.
It’s also a fair, competitor-generated example of the exact thesis this blog champions about agentic coding generally — that the interesting frontier isn’t a chatbot answering questions, it’s an agent given a goal, tools, and enough autonomy to run for weeks and be judged on output. Anthropic’s own version of that thesis runs through Claude Code’s Agent Teams and Dynamic Workflows; Cognition just supplied a case study where the output is a number you can independently check rather than a benchmark score you have to trust. Credit where it’s due.
Sources: Cognition — “Factoring RSA-260” (Sept 2026, primary, direct fetch); independent verification performed for this article (factor multiplication and Miller-Rabin primality testing, 20 rounds); this blog’s prior coverage of Cognition’s SWE-2.
