Most crypto headlines are wrong in a boring way. This one was wrong in an interesting way, which is why it deserves a public dissection instead of a scroll-past.
Hook
Last week a sentence crossed my feed and stopped me cold: "RSA-896 factored with AI assistance, pushing the public record to 896 bits." No algorithm. No polynomial. No sieving region. No core-year estimate. No hardware class. No third-party reproduction. Just a number, a borrowed aura of machine intelligence, and an implied threat to every key still protecting traffic in production.
I have spent enough years auditing contracts and writing failure post-mortems to recognize that silhouette inside a minute. When a factorization record advances by 67 bits in one move, the burden of proof does not sit with the skeptic. It sits with whoever made the claim. On this one, nobody produced a line of it.
I didn't need to model anything to feel the alarm. The record supposedly moved from 829 bits to 896 bits without a single parameter published beside it. That is not how records get announced. That is how narratives get packaged.
So I treated the claim exactly the way I treat a token with a whitepaper and no audit. I asked for the code. I asked for the chain. There was nothing to verify, and nothing to own.
Context
To see why the claim collapses, you need the real ladder of factorization records, not the marketing version.
The modern public benchmark opens with RSA-129, a 426-bit challenge factored in 1994 with the quadratic sieve over distributed volunteer compute. That was a genuine event: full parameters, a clear method, an academic write-up, reproducible end to end. Roughly 600 contributors, eight months of work.
From there the record crawled. RSA-155, 512 bits, fell in 1999. RSA-200, 663 bits, fell in 2005. RSA-768, 232 decimal digits, fell in 2009 under the general number field sieve, and that single run consumed on the order of two thousand core-years. Then the pace slowed, because math does not care about your enthusiasm. RSA-240, 795 bits, fell in 2019. RSA-250, 829 bits, fell in February 2020 using CADO-NFS, and that stood as the public ceiling for years afterward.
Look at the increments. 768 to 795 is 27 bits. 795 to 829 is 34 bits. Each step is a multi-year project built on a shared, mature algorithm. That algorithm is GNFS, and it is not something you swap out when you get restless. Its cost scales roughly as L_n[1/3, 1.923]. That single expression is the whole argument. Because the exponent sits at one-third of the log, cost does not climb linearly with bit length. It climbs brutally. Every extra bit is more expensive than the last. That is why 829 bits held the record for years, and why a 67-bit jump is not a headline. It is a confession.
There is a detail almost nobody mentions. RSA Laboratories terminated its factoring challenge in 2007 and withdrew the remaining prizes. The integers past RSA-200 were never claimed and never will be under that program. So a claim to have factored RSA-896 is not a claim to have won a bounty. It is a claim to have cracked a number that has sat untouched on a dead challenge list for nearly two decades. That framing alone should raise the hairs on anyone who has spent time in this field.
Now add the crypto context, because the piece ran on a crypto outlet and pointed at a crypto audience. Most modern chains do not run RSA at all. Bitcoin and Ethereum sign with secp256k1, an elliptic curve. Solana, Cardano, and much of the newer stack lean on Ed25519, also elliptic. Breaking an RSA factorization record tells you essentially nothing about the security of a curve-based signature scheme. The threat was repackaged for an audience that mostly does not deploy the vulnerable primitive.
The parallel to Bitcoin's own drift is hard to miss. Post-ETF, the asset has become Wall Street's instrument, a settlement rail dressed up in the old peer-to-peer language. The same laundering happens here. An old, narrow cryptographic curiosity gets dressed in frontier-AI language and sold to a community that keeps buying the label rather than the contents.
That is the first place the story smells. The second is what it omits.
Core
I want to be precise about the technical claim, because the loose version is exactly where the panic breeds.
The piece implied that AI assisted the factorization and thereby pushed the record to 896 bits. Take that as a hypothesis and test it against known methods.
Integer factorization has one dominant cost center: the sieving phase of GNFS, followed by a large sparse linear algebra step over an enormous matrix. AI can plausibly touch the edges. Neural networks can help pick polynomials, tune sieving parameters, triage the relation set, or prune noise before linear algebra. Those are heuristic gains. They are real, disciplined work, and they occasionally shave percent-level cost. They do not bend the difficulty curve. There is no theoretically sound neural method that factors a 200-plus-bit semiprime faster than GNFS by orders of magnitude, and none exists for RSA moduli at any size that matters.
Here is the arithmetic that kills the story. RSA-250 at 829 bits cost roughly two thousand core-years of sieving plus a punishing linear algebra burden, and it leaned on a distributed effort across years. Moving to 896 bits is not eight percent harder. Under GNFS scaling it is on the order of seven to eight times the total computation of RSA-250, and RSA-250 was already a lab-scale project. We are now talking tens of thousands of core-years, gigantic relation sets, matrix dimensions that strain memory subsystems, and months of orchestrated compute. That is a compute-engineering problem, not an inference problem. AI does not cut the sieving cost by an order of magnitude, and sieving is where the time and the money actually go.
The linear algebra step deserves a sentence of its own, because it is the quiet killer. After sieving produces enough relations, you build a massive sparse matrix over GF(2) and solve it. At 829 bits, that matrix is already enormous. At 896 bits it grows in every dimension at once, and memory and communication costs scale with it. A team that genuinely cleared that hurdle would be desperate to publish the parameters, because the linear algebra stage is where the engineering glory lives. Silence there is not modesty. Silence there is absence.
The disclosure culture seals it. When RSA-250 fell, the team published the polynomial, the sieving region, the relation count, the matrix details, the hardware, and the runtime. When RSA-240 fell, same pattern. When any serious record falls, the point is reproducibility. Cryptographers want you to check their work. That is the culture.
This article published none of it. Not the algorithm. Not the prime factors. Not even confirmation of which integer was factored. Not whether the target was the actual RSA-896 from the old RSA Labs challenge list, or a self-constructed soft number that merely happens to be 896 bits long. Those are not the same object, and the difference is everything.
That last point deserves its own line, because it is the most likely innocent explanation and also the most damaging to the headline. A "896-bit" number and "RSA-896" are different objects. RSA-896 is a specific integer published by RSA Laboratories. A randomly generated 896-bit semiprime is just a number someone chose with a smooth structure they selected on purpose. If a small demo factored an easy instance and the write-up blurred that distinction, the entire panic is a category error. And if the number was never the challenge integer, the "new record" is fiction on arrival.
There is a third possibility, and it is the one I find most probable. The item was generated. It carries every fingerprint of AI-produced technical news: a striking number, a borrowed frontier modifier ("AI-assisted"), zero methodology, and a source field that resolves to nothing. The comparison table any honest write-up would carry, old record against new record against delta against method against participants, is simply absent.
It is also possible someone confused bits with decimal digits. 896 bits is not 896 decimal digits. The two live in different magnitudes, and a writer who does not know the difference can manufacture a sensation out of a rounding error. When the units are wrong, the event is usually wrong too.
Let me connect this to where I actually work, because the pattern is not new. In 2022 I watched a stablecoin complex detonate in slow motion and shorted the ecosystem as LUNA went to zero. That collapse was not a cryptographic failure. It was a structural one: a yield product built on a maturity mismatch and stacked leverage that performed beautifully while the market rose and broke first when it turned. The mechanism was visible in the contracts months before the peg cracked. Anyone who read the code instead of the marketing saw it coming.
This RSA story is the same disease in a different organ. A headline engineered to perform in a bull narrative, carrying structural risk it refuses to disclose, ready to be repriced the moment someone checks the math instead of the mood.
There is no new cryptography here. There is a new distribution layer for old nonsense.
I have seen the mirror image of this inside DAOs, where "community governance" routinely resolves to four wallets and a multisig. Turnout sits under five percent on most proposals, and the outcome is settled long before the vote closes. I raise that not to change the subject but to name the mechanism. Crypto has built a permanent machine for laundering narrative into fact. Here, that machine took a possibility and printed a record.
Contrarian
The instinctive response to a story like this is to defend RSA. That is the wrong move, and it is exactly the move the story wants you to make.
RSA is not safe. It will not be safe. But this is not the threat. The threat is quantum, and it has a name: Shor's algorithm. A sufficiently large fault-tolerant quantum computer running Shor does not nibble at RSA-2048 the way GNFS nibbles at records. It dissolves it. That is the real endpoint, and it is the one worth pricing.
Here is the blind spot the panic hides. Everybody reading about RSA-896 thinks the danger is that the number got bigger. The danger that actually compounds is HNDL: harvest now, decrypt later. Adversaries are already scraping encrypted traffic and storing it against the day a quantum machine can open it. That risk is live today, in production systems, and it does not care whether someone factored 829 bits or 896. The 896 story is a distraction from a threat already in motion.
So the contrarian position is this: the most dangerous thing about a fake cryptography record is not the panic it causes. It is the urgency it steals. Every hour the industry spends debunking a phantom is an hour not spent on post-quantum migration. NIST has already standardized the replacements: ML-KEM, formerly Kyber, for key encapsulation; ML-DSA, formerly Dilithium, for signatures. The work of ripping RSA out of TLS, PKI, firmware, and ten-thousand-line legacy stacks is enormous, unglamorous, and measured in years. Nobody writes a viral headline about a key-management migration. That is precisely why it matters.
There is a second blind spot, and it is about us. A crypto press funded by attention will always reward the loudest claim. The same incentive structure that turns a governance proposal into four-wallet theater turns a small algorithmic tweak into "AI breaks RSA." Trade on this and you are trading noise.
I keep a short list I run against every one of these stories, and I will hand it over because it is the cheapest risk control you can adopt. Five questions. What is the mechanism? What are the parameters? Who is the source? Has anyone reproduced it? Who benefits from you believing it? If a claim cannot survive those five, it is not news. It is a feeling wearing a lab coat.
I want to state something plainly, because it governs how I read every one of these stories. Hype is a liability; liquidity is the only truth. A fake record has infinite narrative liquidity and zero settlement value. The moment you try to cash it, whether as a migration decision, a security budget, or a position, it evaporates. That asymmetry is the entire game.
Takeaway
Strip out the noise and you are left with a short list of things that will actually move the needle. None of them are this headline.
Watch the source, not the claim. If IACR or NIST or a named academic group confirms an RSA-896 factorization with parameters and a reproduction, the picture changes and I will revise in public. Until then, treat it as unverified content, because that is what it is.
Watch the record, not the rumor. The next genuine factorization record, whenever it lands, will almost certainly sit in the 840 to 850-bit range, not 896. Progression is the fingerprint of real work. Jumps are the fingerprint of marketing.
Watch the migration calendar, not the panic. The number that matters for your security posture is not 896 bits. It is the date your key infrastructure moves to post-quantum primitives, and the length of the runway remaining before a cryptographically relevant quantum computer. That runway shrinks whether or not anyone factors a semiprime this year.
And watch your own attention. The reason a story like this spreads is that it was built to spread. A real record is a document. A fake one is a feeling. You can reproduce a document. You cannot reproduce a feeling, which is exactly the point.
We do not predict the storm; we build the ship. Nobody knows the exact day a quantum machine falls out of the sky onto RSA-2048. Nobody needs to. The ship is the migration. The ship is the audit. The ship is the discipline to demand parameters before you accept a fact.
So here is the question I will leave with you, and it is not rhetorical. When the next "AI breaks encryption" headline lands, and it will, within months, will you check the polynomial before you check your pulse? Trust the code, verify the chain, own the outcome. The people who could not answer that question in 2022 are the ones still underwater. The ones who could are still here.