Translated from the original Japanese article
Tech7 min read

What is known about how Eric Lu factored the 862-bit RSA-260 after 35 years

MathCryptographySecurity
IkesanContents

On September 3, 2026, Cognition engineer Eric Lu (@penlume) posted on X a 130-digit integer followed by nothing but “divides RSA-260”.
RSA-260 is a 260-digit (862-bit) composite from the 1991 RSA Factoring Challenge, and nobody had factored it in 35 years.
Within minutes the RSA numbers page on Wikipedia was updated, and RSA-260 replaced RSA-250 (829 bits, 2020) as the largest number factored with a general-purpose algorithm.

I divided RSA-260 by the posted number in Python on my M4 Mac mini. The remainder was 0 and the other factor also had 130 digits.
Both passed sympy’s primality test.

N = 22112825529529666435281085255026230927612089502470015394413748319128822941402001986512729726569746599085900330031400051170742204560859276357953757185954298838958709229238491006703034124620545784566413664540684214361293017694020846391065875914794251435144458199
p = 4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581
q = N // p
print(N % p == 0, len(str(q)), N.bit_length())   # True 130 862
import sympy
print(sympy.isprime(p), sympy.isprime(q))        # True True

q = 5028695206842569864686141618253083416610081090075366674776775706538324961364412200138116378509733307971876652984898985905923678379.
Both p and q are 431 bits, so RSA-260 is the product of two primes exactly as the challenge stated.

The 1991 RSA Factoring Challenge

RSA Laboratories started the RSA Factoring Challenge on March 18, 1991, as a public set of prize problems, because the security of RSA rests on the assumption that factoring large numbers is hard.
The first series, RSA-100 through RSA-617, is named by decimal digit count, and RSA-260 belongs to it.
The series added in 2001, RSA-576 through RSA-2048, is named by bit length and carried prizes from $10,000 to $200,000.

The challenge itself ended in 2007.
RSA-260 had no prize attached when it ended, so no money changes hands for this factorization.
Still unfactored are RSA-270 and above in the decimal series, and RSA-896, RSA-1024, RSA-1536, and RSA-2048 in the bit series.

Records so far

A core-year, the unit in the table, is the work of one CPU core running for one year.

NumberBitsFactoredCompute
RSA-155512August 1999International team (Alec Muffett among them)
RSA-768768December 2009About 2,000 years on one 2.2GHz Opteron core, two years wall clock
RSA-240795November 2019About 900 core-years on 2.1GHz Xeon Gold 6130
RSA-250829February 2020About 2,700 core-years on the same CPU
RSA-260862September 2026Not disclosed

RSA-240 and RSA-250 were both done by the same six people, Boudot, Gaudry, Guillevic, Heninger, Thomé, and Zimmermann, using CADO-NFS, the open-source Number Field Sieve implementation developed at INRIA and elsewhere in France.
RSA-240 is larger than RSA-768, yet it took less than half the compute.
The announcement attributes the speedup over RSA-768 to a factor of 3 to 4 from algorithms and 1.25 to 1.67 from hardware.
The paper likewise says that algorithmic improvements and parameter choices made the computation much cheaper than extrapolation from earlier records would predict.

About two hours after the post, Alec Muffett, who was on the team that factored RSA-155 in 1999, replied “Hello from RSA-155, and congratulations!”
Silas Alberti, a Cognition founding team member, posted that AI models were confused when asked about it before Wikipedia was edited.

How was it computed

As of September 4, Lu has not disclosed the algorithm, the software, the hardware, or the running time.
The post contains only the factor, and on Hacker News the comments asking for methodology, software, core count, and time taken are still unanswered.

A story that he “sampled random primes by hand for seven months” is circulating, but it started as a joke by his coworker Sean (@_seanyneutron), who wrote “Eric has been sampling random primes and trying them by hand since he joined Cognition 7 months ago. Hard work beats talent”.
At least one aggregator account, AGTP, reported it as fact.
There are about 3.3×10^127 primes with 130 digits, so trying them one at a time does not get you there.

The method is undisclosed, but for a general composite with no small factors, the best known classical algorithm is the General Number Field Sieve (GNFS).
The elliptic curve method and Pollard’s rho find small factors and do nothing against a product of two 431-bit primes.
Shor’s algorithm on a quantum computer would work in principle, but no machine exists that can run it at this size.
Ledger CTO Charles Guillemet wrote the same thing, “No quantum computer was involved here”.

How the General Number Field Sieve works

GNFS constructs x,yx, y with x2≡y2(modN)x^2 \equiv y^2 \pmod N and pulls a factor out of gcd⁡(x−y,N)\gcd(x - y, N). To get there it collects a huge number of relations, pairs whose values on both the rational side and the algebraic number field side factor into small primes, and multiplies together a subset whose prime exponents are all even to obtain a congruence of squares.

flowchart TD
    A[Polynomial selection<br/>find polynomials that fit N] --> B[Sieving<br/>collect relations]
    B --> C[Filtering<br/>drop duplicates and singletons]
    C --> D[Linear algebra<br/>solve dependencies mod 2]
    D --> E[Square root<br/>extract factor via gcd]

Polynomial selection picks, among pairs of polynomials sharing a common root modulo N, the pair whose values are most likely to split into small primes in the later sieving.
The quality of that choice changes how long the sieving takes.
Sieving is the stage that collects those relations by the billions, and the range can be split so that different machines work on their own pieces.
For RSA-250 the announcement breaks the compute down as 2,450 core-years of sieving and 250 core-years for the matrix.
The computation used resources at Grid’5000, EXPLOR, Juelich, and UCSD.
Filtering removes duplicate relations and relations containing a prime ideal that appears only once in the whole set, which shrinks the matrix.
For RSA-250 the linear algebra then ran the block Wiedemann algorithm on a sparse matrix of about 405 million rows.
Splitting the matrix across nodes adds inter-node communication to every matrix-vector product, and for RSA-240 on eight Omni-Path-connected nodes, about 30% of each product was communication.

Estimating the scale

The real compute is unknown, but the formula gives an order of magnitude.
The complexity of GNFS is written LN[1/3,(64/9)1/3]L_N[1/3, (64/9)^{1/3}], which has the form exp⁡(c(ln⁡N)1/3(ln⁡ln⁡N)2/3)\exp\left(c (\ln N)^{1/3} (\ln \ln N)^{2/3}\right), which grows slower than exponential in the bit length but far faster than any polynomial.
Plugging in 829 and 862 bits and taking the ratio gives about 2.6.
Multiplying RSA-250’s 2,700 core-years by that gives roughly 7,000 core-years, though the formula drops lower-order terms and, as RSA-240 showed, parameters move the real number a lot.

Dividing naively, 7,000 core-years spread over 10,000 cores comes out to months.
The linear algebra stage needs large memory and inter-node communication, though, so the actual setup and the wall-clock time are not something you can read off that division.

CADO-NFS has kept developing since 2020.
Whether Lu ran CADO-NFS as is, wrote his own implementation, or how much hardware he used, only his own write-up can answer.

RSA-1024 and RSA-2048 by the same formula

The same formula gives a ratio of about 9×10^10 from 862 bits to RSA-2048, and about 78 from 862 bits to RSA-1024.
RSA-2048 is this computation repeated a hundred billion times.
Extrapolating RSA-250’s 2,700 core-years from 829 bits to 1,024 bits gives a factor of 200, about 540,000 core-years.
RSA-1024 remains unfactored, and NIST SP 800-57 rates RSA-1024 at 80 bits of security or less and does not allow it for applying new cryptographic protection.

For a general-purpose number I think brute force is still the only way.