Claude helped factor RSA-896 - your bank's 2048-bit keys are fine

An Anthropic engineer used Claude to help crack a 270-digit RSA challenge number, pushing the public factoring record from 829 bits to 896 bits. Steve Weis published the result on 19 September 2026, describing how Claude ported CADO-NFS — an existing implementation of the classical General Number Field Sieve algorithm — to run efficiently on GPUs, then orchestrated the job across a fleet of up to 2,048 GPUs using otherwise-idle capacity at Anthropic. The computation ran for about 10 days and consumed roughly 30 GPU-years of compute.

What actually happened

This is not a new attack on RSA. GNFS is the same classical algorithm cryptographers have used for factoring for decades; nothing about its mathematics changed. What Claude contributed was engineering work — adapting an existing codebase to new hardware, running large distributed experiments, and iterating on performance bottlenecks — the kind of specialized, time-consuming systems work that previously limited how large a factoring record any given team could attempt. Weis published the original integer along with its two prime factors, so the result can be checked mathematically rather than taken on faith.

Why 896 bits is not 2,048 bits

The jump matters for research bragging rights, not for anyone's online banking. RSA-2048, the key size used across modern TLS, email and banking systems, is estimated to be roughly a billion times harder to factor than RSA-1024 — and RSA-896 sits well below even that. The previous public factoring record, RSA-250 at 829 bits, stood for six years after being set in February 2020; this result and a separate RSA-260 factoring using a different AI system two weeks earlier both moved the frontier, but neither approaches the size actually deployed in production cryptography.

The one practical takeaway

The real signal here is that AI assistance has lowered the engineering barrier to large-scale classical cryptanalysis — which is worth watching for anyone still running RSA-1024, now squarely within reach of a well-resourced GPU fleet. It is not a reason to panic-migrate off RSA-2048. The sensible move for IT buyers is the boring one: ask vendors about crypto-agility roadmaps, key rotation and post-quantum readiness on their own schedule, not in reaction to a research demo four orders of magnitude smaller than what they actually run.

Sources: postquantum.com, Steve Weis.