RSA cryptosystem faces new classical attack, but widespread panic can wait

On September 3, 2026, Eric Lu of Cognition factored the 862-bit RSA-260 challenge number using GPU-accelerated general number field sieve methods, at a cost of roughly $400,000. That is a meaningful milestone in computational number theory, and it has prompted a reassessment of exactly how much runway RSA’s older key sizes still have. What just happened, and why it matters RSA security rests on a deceptively simple problem: it is easy to multiply two large prime numbers together, but extremely hard to reverse-engineer the original primes from the result. The bigger the key, the harder the reversal. Projections now place the computational expense of factoring an RSA-1024 key at around $30 million. That is not a trivial sum, but it is within reach of nation-states and well-resourced intelligence agencies. RSA-1024 is already deprecated precisely because this kind of threat was anticipated, but the research confirms that the deprecation was not just precautionary theater. RSA-2048, the standard in active, widespread use today, remains secure against both current classical attacks and known quantum approaches. The computational cost of factoring climbs steeply with key size, meaning RS...