No Stack Trace, No Factorization: Dissecting the RSA-896 AI Headline

A claim crossed the wires this week: RSA-896 factored with AI assistance, pushing the public record to 896 bits. No polynomial pair. No sieve region parameters. No matrix dimensions. No hardware inventory. No core-year count. No named laboratory. Just a bit length, a marketing verb, and a mood — reposted within hours as proof that encrypted infrastructure is collapsing. In a bear market, that kind of rumor has an asymmetric cost. Fear is cheap to manufacture and expensive to disprove. There is no exploit to postmortem, no attacker address to trace, no on-chain record to follow. I did not encounter this claim on a research list. I found it circulating in retail channels, pushed by accounts whose function is to convert uncertainty into engagement. That is backwards. Readers do not need another horror story; they need to know which of their assumptions has actually failed. So I ran the claim through the only instrument that matters here: the public record. What came back is not a breakthrough. It is a fabricated milestone bolted onto a real, slow, genuinely important research program — and the distance between those two things is the whole story. Start with a naming collision that has confused nearly everyone repeating this headline. Two distinct families of large numbers live in this field. The first is the RSA Laboratories challenge list, published in 1991: moduli named by bit length, each carrying a cash prize. The largest of those ever factored is RSA-768, broken in 2009 — two decades after publication, and two years after RSA Laboratories had withdrawn the challenge and its prizes. The 896-bit entry on that list has never fallen. It has been public for more than thirty years, and no factor has been published. The second family is the modern factoring record, which counts arbitrary hard semiprimes named by decimal digit length. That record stood at RSA-250 — 250 decimal digits, 829 bits — as of February 2020, produced by a distributed effort using the general number field sieve, coordinated around the CADO-NFS toolchain. RSA-240, a 795-bit number, fell in December 2019. Fourteen months separated them. That is the pace: one meaningful step per year or so, occasionally two, always accompanied by parameters and always reproduced by someone else. These are research milestones on deliberately hard composites, not breaks of deployed systems. So the claim fails twice. The specific 896-bit challenge modulus has never been factored. The general record is 829 bits, not 896 — a gap of 67 bits. That gap is not cosmetic, because under GNFS the cost of factoring grows superpolynomially in the modulus size. There is also no prize anymore. RSA Laboratories closed the challenge in 2007 and withdrew the cash awards, which means a genuine factoring of RSA-896 would be a pure academic result — and academic results are announced by the people who computed them, with their names attached, not through an unattributed feed. Run the standard heuristic — complexity scaling as L_n[1/3, 1.923], where n is the semiprime — and the ratio between 829 bits and 896 bits lands at roughly seven times the total work. That is not a rounding error. The RSA-250 effort already required a distributed sieving campaign and a block Wiedemann linear algebra stage on a large cluster, measured in thousands of core-years. Multiply by seven and you are describing a national-laboratory-scale project, not an inference call. Scale the same heuristic to RSA-2048 and you cross roughly ten orders of magnitude. The modulus size protecting TLS and PKI infrastructure is not in the same building as an 896-bit number, let alone the same conversation. None of this makes AI irrelevant to factoring. It makes the relevant surface narrow. The demonstrated role of learning methods in GNFS is heuristic tuning of sub-steps: scoring polynomial candidates in the selection stage, filtering the enormous relation collections produced by sieving, adjusting parameters that human operators historically set by intuition and benchmark. Those are real gains. Papers on machine-learning-assisted polynomial selection exist and are worth reading. None of them produce a bit-level jump in a public record, because sieving throughput and linear algebra dominate total cost, and neither is an inference problem. There is also no neural architecture that reliably factors hard semiprimes of a couple hundred digits. Learning approaches perform well on smooth numbers and small composites, where structure is discoverable. RSA moduli are constructed to have no such structure. The stack trace doesn't lie: if a method could cross 67 bits, the method would be the news, not the number. The largest RSA Laboratories modulus fell in 2009. The general record has advanced just 61 bits since. Nothing in the intervening years supports a sudden 67-bit jump announced without a single parameter. I have audited AI-driven systems, and the failure pattern there is instructive. In 2026 I assessed an autonomous trading protocol whose oracle feed was vulnerable to latency manipulation. I simulated ten thousand trades; the agents consistently front-ran their own price updates for roughly a two percent edge. The flaw was not in the model's reasoning. It sat at the integration seam — the boundary between a fast decision loop and a slow data source. That is where AI introduces risk: timing, ordering, adversarial inputs. Nothing in that vector helps you sieve a 896-bit modulus. Here is what should end the discussion, and it takes ten seconds. Factoring is the rare cryptographic claim with a trivial verification path. The two prime factors are the proof. Multiply them. If they equal the 896-bit challenge modulus, the story is over; I will retract this article and congratulate the authors. If they multiply to a self-constructed 896-bit composite — one the proposer chose, with a small factor or a smooth structure — the claim collapses. Publishing two large integers costs nothing. Its absence, in a field where verified factors are the entire deliverable, is the strongest available signal that there is nothing to publish. Real records disclose. When RSA-250 fell, the community received polynomial pairs, sieve regions, matrix sizes, target densities, and core-year accounting. That culture is not decorative, because a factoring record only becomes a record through independent reproduction. Compare that with a headline carrying zero technical disclosure and an unattributed source. In 2017, while auditing the 0x Protocol v2 exchange contracts at the peak of the ICO cycle, I stopped reading whitepapers entirely. The documents were fluent, confident, and disconnected from the code. I ran test cases locally instead and found a reentrancy path in the exchange logic that could have drained user funds; the team patched it within forty-eight hours. The lesson did not stop at smart contracts. Every technical claim is either reproducible or it is marketing. One more forensic note: 896 bits is about 270 decimal digits. Two naming conventions, two populations of numbers, one headline borrowing the authority of both. When a claim cannot decide which number it refers to, the ambiguity is rarely an oversight. Where does real RSA risk sit in a crypto portfolio? Almost nowhere in consensus. Bitcoin uses secp256k1 ECDSA and Schnorr signatures. Solana, Near, and much of the modern stack use Ed25519. Neither is touched by a classical factoring record. The exposure is in custody infrastructure: legacy TLS endpoints, hardware security module key wrapping, vendor PKI for attestation, code-signing chains, exchange back-office signing flows still negotiating RSA-2048. I have sat in audits where a firmware update path from 2014 was still carrying RSA keys. That is a problem worth attention. It is not this problem. The uncomfortable part is that the alarm is directionally correct. Classical factoring records are a slow clock, but a real one runs behind the noise: quantum computation executing Shor's algorithm would end RSA as a practical assumption, and harvest-now-decrypt-later means data captured today can be opened whenever that capability arrives. NIST finalized ML-KEM, ML-DSA, and SLH-DSA in August 2024. CNSA 2.0 sets migration targets inside this decade for national security systems. Anyone telling you to move off RSA is giving sound advice, even while holding a fabricated number. The underlying prior is not absurd either. AI has produced legitimate mathematics: AlphaProof's formalized competition results, FunSearch's discovery of new constructions, learning-assisted polynomial selection in NFS. A future in which these methods shave meaningful cost off sieving is plausible. The error is not optimism. The error is presenting a plausible future tense as a verified past tense, with no mechanism, no parameters, and no third party — then borrowing the credibility of an entire research field to sell it. That is the actual security failure in this story, and it deserves a precise name. The attack did not target a modulus. It targeted the reader. "AI-assisted breakthrough" is now a repeatable template: no named actor, no benchmark, no institution to hold accountable, and an audience already primed by two years of genuine AI capability news. In a market desperate for signal, a headline is the cheapest payload available. The "community-driven" information layer crypto prides itself on has no verification stage between a claim and a repost, which makes it an unusually efficient distribution channel for exactly this kind of content. What I expect from here is slow and unglamorous. The next genuine factoring record will likely land in the 840-850 bit range, come from an academic or distributed team with GNFS experience, and arrive with full parameters and a reproduction path — published on IACR ePrint or an established factoring list, not in a social feed. The signals worth tracking are not bit-length headlines. They are NIST's post-quantum deployment schedule, RSA deprecation timelines across TLS and PKI, and whether your custodian can produce an attestation you can actually verify. So keep one question ready, because it costs nothing and defeats almost everything: where are the factors? Demand the polynomial. Demand the core-year count and the institution that ran the linear algebra. A real record survives all three questions in an afternoon. A fabricated one survives none of them. If a claim about breaking cryptography cannot answer the first, it is not a warning. It is inventory.