Cognition's Devin Breaks RSA-260 Record in Three Weeks With AI Agents

Cognition just published the largest publicly solved RSA Factoring Challenge number to date, and the interesting part is not the 260 digit semiprime itself. The story is how they got there: a single researcher pointed swarms of Devin agents at the problem and let them rewrite one of computational number theory's most specialized codebases for GPUs. The writeup is a rare, concrete case study of an autonomous coding agent producing a genuine performance-engineering result at the research frontier.

What actually got shipped

RSA-260 sets a new record for the largest publicly solved RSA Factoring Challenge problem, which benchmarks the feasibility of breaking the RSA cryptosystem. The previous record, RSA-250, was set in February 2020. The factorization was produced by a new GPU implementation of the general number field sieve (GNFS), the fastest known classical algorithm for factoring numbers above roughly 100 digits.

The concrete deliverable is a heavily modified fork of CADO-NFS, the standard open-source GNFS implementation, with almost every performance-critical stage rewritten to run on NVIDIA GB200, GB300, and B200 hardware. The team reports essentially no algorithmic advancements, just "good old performance engineering" to take advantage of GPU memory systems.

The 10x cost claim, in numbers

The full factorization consumed about 4,900 GPU-days, or 13.5 GPU-years, which is roughly $400k at current market prices. That breaks down as:

• 643 GPU-days in polynomial selection (anomalously high due to operator error)
• 3,813 GPU-days sieving
• 467 GPU-days linear system solving, with about 7% wasted to crashes or preemption

Scaling that up to real cryptographic key sizes gives more provocative numbers. RSA-1024 is roughly 78x more computation than RSA-260, putting the estimated cost of factoring an RSA-1024 modulus at market GPU prices at around $30M, with the author noting further optimization could plausibly halve that. Two caveats worth flagging: RSA-1024 has been deprecated since 2013 and its insecurity is old news, and the efficiency gains have little impact on the feasibility of factoring RSA-2048-sized numbers, which remain roughly a billion times harder than RSA-1024.

Why sieving on GPUs was hard

Lattice sieving is the dominant cost in GNFS. It is embarrassingly parallel but nasty for GPUs: each work item performs a large number of reads and writes at pseudorandom locations in a large array, and handling this was the primary technical challenge in optimizing the stage. Historically, every public GNFS record used CPU sieving. It was not clear that GPU lattice sieving could be more cost-effective overall, and prior public records used only CPUs for this step.

The workload also happens to be a perfect fit for spare compute in an AI training cluster. Lattice sieving is embarrassingly parallel over billions of small work units, can make progress using single nodes at a time, and is safe to preempt instantly. Cognition ran the whole thing at no marginal cost on idle single-node fragments left over from LLM training on NVL72 racks.

Inside the Devin workflow

The researcher, Eric Lu, wrote a short prompt asking Devin to build a drop-in GPU replacement for CADO-NFS's CPU siever las, gave it Modal API keys for a single test GPU, and went to bed. He woke up to a working prototype that beat the CPU version. From there:

• Across the 3-week project he ran an average of 3 and a maximum of 18 concurrent Devin sessions.
• Sessions split into two types: iteratively optimizing individual components (design experiments, interpret results, implement changes, repeat), and orchestrating end-to-end factorization runs on the cluster.
• Devin handled parameter tuning for sieving and linear solving, polynomial selection, the iterative optimization loop, debugging, processing scripts, and orchestrating large-scale cluster computation.
• Devin sent 82,702 words across 3,328 messages in 192 sessions used for factoring, totaling 14,450 ACUs, with 36 sessions receiving no human intervention at all.

The scaling ladder tells the story. For the first five days the team climbed steadily; by the end, factoring a 190-digit number took the same amount of time as a 157-digit number had at the start, a little over 3 hours. After tackling a 311-digit special number, they jumped straight to RSA-260 rather than incrementally advancing.

Where the human stayed in the loop

Lu is careful not to oversell autonomy. The human role was executive function: setting a hierarchy of goals, catching when the agent was measuring the wrong thing, spotting repeated inefficiencies, suggesting untried optimization directions like using NVLink SHARP or preventing GPU-CPU blocking, and organizing benchmark infrastructure so results stayed comparable across runs.

Two structural observations stand out. This effort would not have been possible without CADO-NFS, which provided all the relevant techniques, the pipeline stages and their interfaces, and a reference CPU implementation. The human decomposition of the problem was essential. And the further the codebase drifted from upstream CADO-NFS, the more confused the agents became, which hints that pretraining exposure to the reference code was doing real work.

What actually changed under the hood

Devin substantially modified nearly every stage of the pipeline. The touched components include:

• A GPU-adapted stage-1 polynomial selector combining CADO and msieve kernels
• The GPU lattice siever glas, a rewrite of CADO's las
• An optimized CADO head to handle the workunit volume
• Parallelized dup/purge and fused merge/replay programs
• A new GPU-optimized block Wiedemann implementation for the linear algebra stage
• GPU-accelerated square root, which had to be rewritten three times when the initial implementation overflowed GMP's limb counter on the 1.76e11-bit rational product

Why this matters beyond one record

The cryptographic angle is real but limited. RSA-1024 was already assumed broken by well-resourced adversaries, and RSA-2048 is unaffected. The more interesting shift is who can now attempt this class of work. Costs may drop, more parties become capable of performing factorizations because commodity GPUs replace specialized hardware, and non-cryptographers can now credibly work on speeding up the pipeline.

Lu is explicit that he is not an expert in the underlying math. He compares his understanding of GNFS components to that of a mid-level car hobbyist. A hobbyist-level operator plus a fleet of agents produced a world-record implementation in three weeks, using single-digit percentages of a cluster as a side project. Devin substituted for what would likely have been a multi-month effort by a team of highly specialized domain experts.

If your work sits at the intersection of programming and a well-defined research problem with a solid open-source reference implementation, this result suggests the barrier to entry has dropped substantially. The catch is that reference implementation. Agents did their best work when optimizing recognizable code, and struggled as the fork diverged from what they had seen in training.