A headline crossed my feed with no date, no author, and a source field that read, simply, none. The claim was that RSA-896 had been factored with AI assistance, pushing the public record to 896 bits.
Every timestamp is a potential crime scene. This one had no timestamp.
So I checked the record instead. The largest general-purpose factoring result ever published is RSA-250 — 829 bits, 250 decimal digits — completed in February 2020 with CADO-NFS and released alongside its full polynomial selection, a sieve region on the order of two to the thirty-two by two to the thirty-one, the dimensions of the linear algebra matrix, and a compute bill measured in thousands of core-years. RSA Laboratories stopped administering its factoring challenge in 2007 and withdrew the prize money with it. RSA-896 exists as a challenge number. It has never been factored by anyone, using anything.
Sixty-seven bits of claimed progress, asserted in one sentence, with zero parameters attached.
That is not a record. That is a gap in the ledger.
The ladder, and how it is normally climbed
Public factoring records do not simply appear. They accrete, slowly, and every rung carries paperwork.
RSA-129 fell in 1994 at 426 bits, coordinated across roughly 1,600 machines over eight months and priced at an estimated 5,000 MIPS-years — the first result that proved distributed factoring was a coordination problem rather than a hardware problem. RSA-155 followed in 1999 at 512 bits. RSA-200 in 2005 at 663 bits. RSA-768 in 2009 at 232 decimal digits, consuming something on the order of two thousand core-years of sieving. RSA-240 in late 2019 at 795 bits. RSA-250 in early 2020 at 829 bits, with sieving on the order of 2,700 core-years on 2.1 gigahertz Xeon Gold silicon, plus roughly 500 core-years of linear algebra stacked on top.
Read that sequence again. Fifteen years of coordinated academic effort moved the record 106 bits — 663 to 829 — and every step was published with a paper, a parameter set, and a reproduction path.
The claimed jump here is 67 bits in a single step. That is not a rung. That is most of a decade of the ladder's total climb, appearing at once.
The arithmetic of sixty-seven bits
The general number field sieve's heuristic complexity is L_n[1/3, 1.923]. I will spare you the derivation and give you the consequence, because the consequence is the whole argument.
The work required scales super-polynomially in the size of the modulus. Running the numbers, 896 bits is approximately seven times the sieving cost of 829 bits. That places the claimed result somewhere on the order of fifteen to twenty thousand core-years of relation collection, plus a linear algebra phase whose matrix is too large for any single machine and must be distributed across a cluster with enough aggregate memory to hold it. RSA-250's matrix already required distributed block Wiedemann. At 896 bits the matrix does not get smaller.
That is national-lab-scale or large-consortium-scale work. It is not a weekend. It is not a single forward pass.
And the more important number: 896 bits against RSA-2048. The same formula returns roughly ten orders of magnitude — on the order of ten billion times the work. Factoring 896 bits says almost nothing about 2048 bits. The two are not on the same practical continuum. Anyone who read the headline and silently substituted "RSA is broken" has made a substitution the arithmetic does not support.
What AI can and cannot do inside GNFS
Here is where the claim gets interesting, because it is not absurd on its face. It is only unsupported.
There is no known learning-based method that factors 200-plus-digit semiprimes. The theoretical work is real and narrow: neural approaches have shown promise on smooth numbers and on small-scale instances where the search space is navigable, and those results do not transfer upward. For a 270-digit semiprime generated to be hard, the sieving phase is the bottleneck, and sieving is a combinatorial collection problem, not a pattern-recognition problem.
Where machine learning plausibly touches the pipeline: polynomial selection scoring, where models have been trained to predict the Murphy-E score of a candidate polynomial without fully evaluating it. Sieving region heuristics. Relation filtering and duplicate detection. Parameter tuning. All of these are sub-step optimizations. They are real. They are also worth single-digit percentages against a workload whose size is set by the modulus, not by the heuristics wrapped around it.
Sub-step heuristics do not buy you sixty-seven bits. They buy you a slightly cheaper run at the size you were already attempting. The bug hides in the whitespace you skipped — and the whitespace here is the entire mechanism of the claimed speedup, which was never stated.
The disclosure norm that wasn't
Real factoring results are announced by people who want to be checked.
A serious release includes the polynomial selected for the algebraic side and the rational side, the size of the sieving region and the bounds on the large primes, the number of relations collected, the filtering parameters, the dimensions of the matrix, the linear algebra method, and the wall-clock and core-hour costs of each stage. That is not vanity. That is the minimum required for a third party to attempt verification.
This claim shipped a sentence.
I spent ninety days inside the 0x Protocol v2 contracts in 2018 and found seven reentrancy paths that automated scanners missed. The methodology was line-by-line reading, and it worked because the code was there to read. Here there is no code to read. Silence in the logs screams louder than alerts. When a cryptographic result arrives with no polynomial, no sieve bounds, no core-years, no named hardware, no consortium, no paper and no authors, the correct prior is not "exciting breakthrough." The correct prior is "unverified artifact." Trust is a variable, never a constant, and this artifact has no evidence to raise the variable.
The two confusions that make the headline land
The first is bits against decimal digits. A 896-bit number is 270 decimal digits. The two units differ by a factor of roughly 3.32, and the crypto press switches between them constantly, sometimes deliberately. If the underlying event — assuming there was one — involved a 270-digit or an 896-decimal-digit number, or a specially constructed composite with known factors, the story changes entirely. A soft number with planted factors is not a factoring result. It is a demo wearing a record's clothes.
The second confusion is worse, and it is the one that actually matters to anyone holding assets. Classic factoring records and quantum cryptanalysis get merged in the public imagination. They are different threats with different timelines. The reason RSA is expected to eventually die is Shor's algorithm running on a fault-tolerant quantum computer with millions of physical qubits — and no such machine exists. A classical NFS record, real or imagined, is not a step toward that. It is an adjacent headline. The industry's genuine long-horizon problem is harvest-now-decrypt-later: adversaries capturing long-lived encrypted traffic today against a future capability. That threat is real, it is already priced into migration timelines, and it is completely unaffected by this article either way.
What the bulls actually got right
I am not going to pretend the panic points at nothing.
The post-quantum migration pressure is legitimate, and it is late rather than early. NIST finalized ML-KEM, ML-DSA and SLH-DSA in 2024, and the standards bodies have been explicit that migration is a decade-scale engineering project that should have started yesterday. Key management infrastructure, hardware security modules, firmware signing chains, long-lived PKI roots — all of it holds RSA material with multi-decade validity windows. Some embedded and industrial systems will be running RSA-1024 long past the point where anyone is willing to admit it in a procurement document.
There is also a real asymmetry in the crypto-native reaction. Most modern chains run secp256k1 or Ed25519. They do not use RSA at all. A factoring result against an RSA modulus — even a real one — is not a blockchain break, and treating it as one is a category error committed by people who have never opened their own wallet's signature scheme. The elliptic-curve side is, if anything, more exposed to Shor than RSA is, because a 256-bit curve falls to a smaller quantum machine than 2048-bit RSA. Nobody wants to hear that, because the upgrade path is uglier.
And the "AI for science" record deserves the benefit of the doubt in the abstract. AlphaProof produced a silver-medal-equivalent performance at the 2024 International Mathematical Olympiad. FunSearch produced a genuinely new construction in the cap-set problem. Neural branch-and-bound has beaten classical heuristics on mixed-integer programs. These are peer-reviewed results with reproduction paths. That is precisely why the RSA-896 claim stands out. The field has produced actual wins, and this claim imitates their shape without their substance.
The five questions, and a prediction
I have spent thirteen years reading code and headlines, and the filter has not changed.
What is the mechanism? What are the parameters? Who is the source? Has anyone reproduced it? Who benefits from you believing it?
Five questions. A real result survives all five in under an hour. This one fails on the second, fourth and fifth before you reach the abstract.
When the MakerDAO liquidation cascade hit in March 2020 I spent three days pulling block numbers to establish exactly where the price feed lagged. That report survived scrutiny because every claim had a block height attached. Parameters are not decoration. They are the difference between a finding and a rumor.
So here is the forward-looking part, and it is falsifiable. The next genuine general-number-field-sieve record will land in the 840-to-870-bit band, not at 896. It will arrive with a polynomial, a sieve region, a matrix dimension and a core-year count. It will be attributed to a named consortium — the CADO-NFS group, a European academic lab, a university cluster — and it will be followed within weeks by an independent verification attempt. It will not be announced by a crypto news aggregator with an empty source field, and it will not be described as AI-assisted, because the people doing the work are precise about what their tools did.
Watch that band. Watch the parameter annex. Everything else is narrative, and narrative does not factor integers.
The ledger bleeds where logic fails to bind. Code does not lie; it merely waits — for the parameters that never came.
