Factoring RSA-896 Took 30 GPU-Years and Checking It Took Us 40 Milliseconds

On September 19 a cryptographer published a page with three numbers on it and almost nothing else. No hardware list, no method, no acknowledgements. Just RSA-896, a 270 digit challenge number nobody had publicly factored, and the two 135 digit primes that multiply to it.

That was the entire post, one sentence and two primes. We pasted the numbers into Python, and the multiplication came back equal in about a thousandth of a millisecond. The run that produced them reportedly needed 2,048 GPUs for ten days.

What the announcement actually says

The post is by Stephen A. Weis, and the full text of the claim is one line: "RSA-896 is a RSA challenge number I factored with Claude on September 19, 2026." Then RSA-896 =, then p =, then q =. Nothing about how.

Two pieces of context the post does not give you and we think you should have. Weis's own bio page says he is currently a member of technical staff at Anthropic on the Secure Frameworks team, and that he received a PhD from MIT where he was advised by Ron Rivest. Rivest is the R in RSA. So the person who factored an RSA challenge number with Anthropic's model works at Anthropic, and did his doctorate under one of the people who named the problem. None of that makes the result wrong. It does mean the phrase "scavenged idle capacity", which turns up later, is worth reading carefully.

Wikipedia's RSA numbers page has already been updated to record the factorization, and the two primes listed there match the blog post exactly. The only citation on that entry is the blog post itself.

We checked it, because you can

This is the rare record where independent verification is free, so there is no excuse for taking it on faith. We scraped the three numbers out of the page, stripped everything that was not a digit, and ran four checks in Python 3.

First, sizes. The challenge number is 270 decimal digits and 896 bits, which is what the name promises. Both factors are 135 decimal digits and 448 bits each, so they are balanced, which is what an RSA modulus is supposed to look like.

Second, the multiplication. p * q == N returned True.

Third, we compared the N from the blog post against the RSA-896 value published on Wikipedia's RSA numbers page, digit for digit. Identical. This matters more than the multiplication does: two primes multiplying together proves nothing if the product is not the number everyone agreed to care about.

Fourth, primality. We ran 64 rounds of Miller-Rabin against each factor with random bases. Both passed.

N  digits 270 bits 896
p  digits 135 bits 448 | q digits 135 bits 448
blog N == wikipedia N ?  True
p*q == N ?               True
multiply took            0.001 ms
p probable prime?  True  (19.5 ms, 64 rounds)
q probable prime?  True  (20.0 ms, 64 rounds)

Total verification cost on a laptop, including the two primality tests: about 40 milliseconds. The claimed production cost was roughly 30 GPU-years. That gap is not a footnote to the story, it is the story. Trapdoor asymmetry is the entire premise of RSA, and here it is with a stopwatch on it.

The method is in a thread, not in the post

The blog post says nothing about how the computation ran. The details came out on X and were quoted into the Hacker News thread by the user madars. Weis is active in that same thread under the handle sweis, and he has not disputed the quote, so we are treating it as accurate while noting it is not on the blog.

According to that quote, Claude ported CADO-NFS to run on GPUs, then orchestrated a fleet across what he calls "scavenged idle capacity". The run peaked at 2,048 GPUs and consumed about 30 GPU-years over ten days.

The caveats came from Weis himself, and they are the kind of caveats that do not usually survive a press cycle: no new algorithmic factoring improvements, and no new threats to deployed keys. He also wrote that factoring is "still exponential", was corrected in the thread by a commenter pointing out that the general number field sieve is subexponential, and replied "I misspoke and corrected down thread." We are noting that because a record holder publicly correcting his own complexity claim within hours is a reasonable signal about the rest of it.

CADO-NFS is open source and implements the general number field sieve, an algorithm from the 1990s. It is the same software behind the 2020 record. The new part is the GPU port and the orchestration, not the math.

The record it broke was 16 days old

This is the part that surprised us most. RSA-896 is not the first factoring record to fall this month.

Number	Bits	Date	Who	Reported effort
RSA-250	829	Feb 2020	Boudot, Gaudry, Guillevic, Heninger, Thome, Zimmermann	~2,700 CPU core-years
RSA-260	862	Sep 3, 2026	Eric Lu, Cognition	~4,900 GPU-days (~13.5 GPU-years)
RSA-896	896	Sep 19, 2026	Stephen A. Weis	~30 GPU-years over 10 days

Two caveats on that table, both important. CPU core-years and GPU-years are not the same unit and cannot be divided into each other, so the 2020 row is context, not a comparison. And the two 2026 rows used different GPUs on different infrastructure with no published per-device detail, so "30 versus 13.5" tells you about the size of the numbers and very little about the efficiency of either run.

What the table does show cleanly is the shape of the year. The public record stood still from February 2020 to September 2026, then moved twice in 16 days, both times via a GPU port of CADO-NFS driven by an AI coding agent, both times at an AI company. Cognition used its own Devin agents for RSA-260.

The record stood for six years, then moved twice in sixteen days.

One detail we enjoyed: the next number on the challenge list, RSA-270, is 270 digits and 895 bits. One bit smaller than the number that just fell, and still unfactored.

The sharpest pushback was not about the math

The Hacker News thread sat at 164 points and 61 comments when we read it, and the skepticism clustered on two things, neither of which was whether the factors are correct.

The first was whether GPUs are even the right tool. The commenter charlieyu1 argued that "integer factorisation is not something you can really improve with GPUs" and that "a bunch of cheap CPU cores would do just as well with much lower hardware cost and electricity cost." We cannot settle that from the outside, because neither 2026 run published the per-stage timings you would need to. Sieving parallelises well, the linear algebra step historically does not, and nobody has shown their split.

The second was the framing. gizmodo59 put it in eight words: "You don't need AI to solve this. Just lots of compute." redox99 was blunter, writing that it is "quite bearish on Anthropic if they had nothing better to do with 2048 GPUs for 10 days than finding an RSA number with already existing algorithms." And JoshTriplett supplied the obvious reading of "scavenged idle capacity": the author works at Anthropic, so it is probably idle capacity in Anthropic's datacenters.

The thread also killed a recurring hope early. RSA Laboratories did offer $75,000 for RSA-896, but as the commenter tristanj noted, the contest ended in 2007. Nobody is getting paid.

This is not a reason to rotate anything

What it is a reason for: finally retiring anything still under 1024 bits. One commenter pointed out that Instagram was still publishing a 768-bit RSA DKIM key, and RSA-768 has been factored since 2009. If a 896-bit number now falls to ten days of spare capacity at a company that had nothing better to do with it, a 768-bit key in production is not a theoretical problem. Go check your DKIM records and your older internal CAs. That is the actionable output of this story, and it is smaller and more boring than the headline suggests.

The trend worth watching is the incentive. Idle GPU capacity at AI labs is now large enough that burning 30 GPU-years on a 25 year old math challenge is a rounding error, and it makes a nice demo of an agent doing real systems work. We would bet on RSA-270 falling before the end of the year, and on the announcement post being just as short.

Your turn

The verification here took us 40 milliseconds, so we are curious about the other side: what is the smallest RSA key you can still find running in something you own or depend on? DKIM selectors are the usual offender, and they are one DNS query away from an answer. If you find something under 1024 bits, we want to hear which system it was hiding in.

If you want more on what Anthropic itself publishes about how its models get used at the sharp end, our writeup of Anthropic's September threat intelligence report covers the same company disclosing specific numbers about specific misuse, which is a useful contrast to a one sentence announcement with no method in it.