RSA-260 Just Fell. We Verified It in Three Lines of Python.

On September 3, 2026, an account posted a 130-digit number and one sentence: that it divides RSA-260. The post has 6.1 million views.

RSA-260 is a 260-decimal-digit, 862-bit semiprime from the RSA Factoring Challenge, the list RSA Laboratories published in 1991 to give the world a public yardstick for factoring difficulty. It had stood unfactored for 35 years. The previous record on that list, RSA-250, fell in February 2020.

What makes this story unusual is not the mathematics. It is that the claim is checkable by anyone in about ten seconds, and that a large fraction of the summaries circulating about it are nonetheless wrong.

TL;DR

Verify it yourself

This is the whole point, so let's do it rather than describe it. Factoring a semiprime is hard. Checking a claimed factorization is one multiplication.

p = 4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581
q = 5028695206842569864686141618253083416610081090075366674776775706538324961364412200138116378509733307971876652984898985905923678379

n = p * q
print(len(str(n)))   # 260
print(n.bit_length()) # 862
print(n)

That prints:

2211282552952966643528108525502623092761208950247001539441374831912882294140
2001986512729726569746599085900330031400051170742204560859276357953757185954
2988389587092292384910067030341246205457845664136645406842143612930176940208
46391065875914794251435144458199

Which is RSA-260, exactly, digit for digit, as published. We ran this before writing this post. You should run it before believing this post. That asymmetry — expensive to produce, trivial to check — is the same property that makes proof-of-work and verifiable computation useful, and it is worth internalising as a general habit for evaluating claims.

Why your TLS certificate is fine

The reflexive reaction to "RSA factored" is "is my encryption broken." It is not, and the reason is worth understanding rather than taking on faith.

The general number field sieve runs in sub-exponential time in the size of the modulus. Sub-exponential is much better than exponential, and it is still catastrophically steep. Going from 829 bits to 862 bits — the step just taken — is a modest increase in work. Going from 862 to 2048 is not a bigger version of the same step; it is a different universe of cost, far beyond anything achievable with all the computing capacity currently in existence.

Two more calibrations from the record itself:

• 26 years separate RSA-155 (512-bit) from RSA-260 (862-bit). That is 350 bits in a quarter century, and the curve gets harder, not easier.
• RSA-250 cost roughly 2,700 CPU core-years in 2020. Whatever RSA-260 cost, it was not less.

And, as one cryptographer put it flatly in the thread within the hour: no quantum computer was involved here. This is classical number theory in the direct lineage of the 1999 and 2020 results — which is also why a researcher from the team that factored RSA-155 turned up in the replies to congratulate someone who was not born when that record was set.

Why the challenge list exists at all

RSA Laboratories published the RSA Factoring Challenge in 1991 for a reason that has aged well: cryptographic key sizes are chosen against a predicted cost of attack, and predictions drift. The list gave the world a public, unambiguous scoreboard — a set of semiprimes of known size that anyone could attack and whose fall would be immediately verifiable by anybody.

The value is calibration. Every entry that falls tells you, concretely rather than theoretically, where the classical frontier actually sits:

Read down that column and the story is not acceleration — it is a frontier advancing roughly 13 bits a year against a 2048-bit target, with each additional bit costing more than the last. The challenge was formally retired years ago and no prizes are paid, which makes it a purer signal now than it was: the people still working on these numbers are doing it for the record, not the money.

It is also why "RSA-260 fell" is a reassuring headline once you read it properly. A public benchmark advancing on schedule is the system working. The alarming version of this news would have been a 2048-bit modulus, or a method that changed the shape of the curve rather than a point on it.

The part that belongs on an AI blog

Within hours, summaries of this story — including AI-generated ones — were confidently reporting that the factor was found by testing random primes by hand over about seven months.

That is not merely unlikely. It is arithmetically impossible, and you can show it in one line.

By the prime number theorem, the count of primes with 130 digits is roughly:

10^130 / ln(10^130) ≈ 10^130 / 299 ≈ 3.3 × 10^127

So a random 130-digit prime has about a 1 in 3.3 × 10^127 chance of being the right one. For scale, the observable universe contains on the order of 10^80 atoms. Seven months of trials — even at a billion trials per second, which is not what "by hand" means — gets you to about 10^16 attempts. You are short by roughly 111 orders of magnitude.

So what happened? Almost certainly a compressed or joking remark got flattened into a factual claim by a summariser, then repeated by other summarisers reading the first ones. No individual step was malicious. The result is that the single most-asked question about this story — how — currently has a widely-distributed wrong answer that any reader could have disproved with the prime number theorem and a calculator.

This is the failure mode worth taking from the whole episode, and it generalises well beyond cryptography:

• A verifiable claim and its explanation have completely different trust profiles. The factor is checkable in ten seconds. The method is unverifiable narrative. Summaries flatten both into the same confident register.
• Errors compound through summarisation chains. Once a plausible-sounding method is in circulation, downstream summaries cite each other rather than the source, and confidence rises while evidence does not.
• The fix is mechanical, not attitudinal. When a claim reduces to arithmetic, do the arithmetic. When it does not, say the method is undisclosed. We wrote about the underlying dynamic in LLMs, math, and verifiable answers, and about how confident-sounding sourcing gets manufactured at scale in manufactured GEO farms and AI recommendation sources.

If you build anything that summarises news for users, this is a live example of the exact failure your evals should be catching, and it happened in public with a ground truth available.

What engineers should actually do

Nothing urgent. Two things eventually, both of which were already on the list:

1. Audit for sub-2048-bit RSA. Modern TLS stacks refuse small keys, but legacy internal PKI, old device firmware, and long-lived code-signing keys are where 1024-bit keys quietly survive. This record does not threaten 2048-bit keys; it is a good prompt to confirm you have none below that. The broader hygiene checklist is in our MCP and agent security guide.
2. Keep post-quantum migration on its existing schedule. Nothing about a classical 862-bit factorisation moves the quantum timeline. But it is a concrete reminder that key sizes have a shelf life, and hybrid key exchange is already shipping in mainstream TLS stacks.

That is genuinely it. The correct emotional response to this story is enjoyment, not alarm.

Honest limitations

• The method is undisclosed. As of September 3, 2026 we have found no published write-up of the compute, the algorithm, or the wall-clock time. Everything circulating on "how" is speculation, including the impossible version debunked above.
• Attribution is reported, not confirmed by us. Coverage identifies the poster as Eric Lu, an engineer at Cognition. We verified the factorization, which is independent of who did it.
• We verified divisibility and digit count, not primality. Confirming both factors are prime requires a primality test we did not run; the product matching RSA-260 exactly is the claim we checked.
• The 2,700 CPU core-year figure is RSA-250's, not this record's. It is included for calibration and should not be read as an estimate of what RSA-260 cost.
• This is not cryptographic advice for a specific system. If you operate PKI with unusual constraints, talk to someone who does that full time.

Related on explainx.ai

• LLMs, math, and verifiable answers
• Manufactured GEO farms and how AI picks its sources
• MCP security — the complete guide
• Agent skills security threats and verification
• Tsinghua breaks the sorting barrier in Dijkstra's SSSP
• Ed Zitron's AI prediction track record
• Sam Altman's almond-water claim, fact-checked

Primary sources: RSA numbers — Wikipedia · RSA Factoring Challenge

Factorization verified by us on September 3, 2026 by multiplying the two published factors and comparing against the RSA-260 challenge number of record. Attribution and the absence of a published method reflect available reporting on that date; if the author publishes a write-up, the "how" section here will be out of date.