Hook
On a Tuesday morning, a headline crossed my feed: "RSA-896 factored with AI assistance, pushing the public record to 896 bits." I had three terminals open at the time โ one running a CADO-NFS parameter sweep, one watching on-chain, one holding the last published factoring record. None of them agreed with the headline. The public record for factoring RSA moduli sits at RSA-250 โ 829 bits, 250 decimal digits, February 2020, plain GNFS, no AI halo. A jump to 896 bits is a 67-bit leap. That is not a data point. That is a discontinuity. In fourteen years of reading records and reading bytecode, discontinuities have never once been a gift. They have been either a measurement error or a lie with good typography.
Context
To see why, you have to know what the record actually measures. RSA factoring is not a race of cleverness; it is a race of the general number field sieve, whose heuristic cost grows as L_n[1/3, 1.923]. That exponent is not negotiable. It means every additional bit costs more than the bit before it, and the cost curve is convex, not linear. The ladder confirms it: RSA-240 at 795 bits (2019), RSA-250 at 829 bits (2020) โ a 34-bit step across roughly a year of coordinated academic effort. Records move in increments, because the work is sieving plus linear algebra at scale, thousands of core-years of it, and you cannot skip rungs you did not pay for.
Second piece of context, and this is where the article's body language betrays it: real records ship with artifacts. When CADO-NFS and its collaborators announced RSA-250, they published the polynomial, the sieve region, the matrix size, the hardware, the core-years. That disclosure is not courtesy โ it is the reproducibility protocol. A result without parameters is not a result. It is a claim wearing a lab coat.
Core Insight
Let me dissect the mechanism the headline implies, because "AI assistance" is doing a great deal of unexamined work here.
GNFS has stages: polynomial selection, sieving, relation filtering, linear algebra, square root. A machine-learning model could plausibly act on the front of that pipeline โ choosing better polynomials, tuning sieve parameters, triaging relations. Those are heuristic gains, marginal multipliers on sub-steps. AI does not change the asymptotic exponent of GNFS. There is no known neural method that factors 200+ digit semiprimes, and none that removes the sieving bottleneck, which is where the compute actually dies.
So run the arithmetic. 896 bits is roughly 7 to 8 times the work of 829 bits under the GNFS heuristic. RSA-250 already consumed thousands of core-years at the sieve stage. 896 bits lands in the tens of thousands of core-years. That is a national-lab-scale, distributed-volunteer-scale project โ not something an "AI run" produces over a weekend. If a genuine 896-bit factorization had occurred, the announcement would come from number theorists and cryptographers, not a newsroom. And it would be a 7-8x compute event, not an algorithm event.
Then there is the missing-parameter problem, which for me is decisive. Based on my audit experience, the tell is always the same: when a claim is real, the claimant drowns you in specifics, because the specifics are the proof. When a claim is synthetic, the specifics are absent because they were never computed. This headline offered one sentence and zero numbers. No polynomial. No sieve region. No core-years. No named AI system, no institution, no authors. Source field: unknown. Origin: none.
I have watched this pattern at the code level before. I once spent six months porting early Gnosis Safe multi-sig versions, and found an integer overflow in an initialization function that never shipped โ because the bytecode showed it before the marketing could hide it. The lesson stuck: the truth is in the artifact, not the announcement. I saw the same inversion during the 2020 DeFi flash-loan reviews, where the vulnerability that mattered was five lines deep in an accounting module โ invisible on the dashboard, obvious to the disassembler. A factoring claim without NFS parameters is a dashboard with nothing behind it.
There is also a units trap. 896 bits is not 896 decimal digits. Conflate them and the "record" migrates from implausible to absurd. Half of these headlines are unit errors that survive because the audience no longer knows the difference between bits and digits โ and increasingly, neither do the writers.
Contrarian Angle
Now the counter-intuitive part, the blind spot shared by both sides of this argument.
The skeptics win the fact-check and lose the framing. Even granting the claim for a moment: RSA-896 is not RSA-2048. Production TLS, PKI, and most enterprise key material run at 2048, 3072, or 4096 bits. A 896-bit factorization, even if real, does not threaten practical RSA by an order of magnitude โ the gap between 896 bits and 2048 bits is roughly 10^3 in GNFS cost. Factoring a museum piece is not breaking the deployment.
Worse, the entire panic cycle misses the actual threat vector. RSA does not fall to classical factoring records. It falls to Shor's algorithm on a sufficiently large fault-tolerant quantum computer โ a completely different mechanism that these headlines never mention. So the editorial machinery manufactures classical-factoring terror while the genuine long-horizon risk sits unlabeled one aisle over. That is not a security warning. It is noise with a chart.
And here is the deeper forensic point, the one that should worry a chain auditor more than the headline itself. The most dangerous thing in this story is not a broken cipher. It is a broken information supply chain โ a feed that moves "record advancement" to "RSA broken" in a single ambiguous headline, unpriced and unaudited. Liquidity is just trust with a price tag, and information liquidity now trades at the same premium. In a bull market that mispricing compounds: junior teams read "RSA broken," panic-migrate keys, and burn engineering cycles on a threat that is not the threat. I have audited MPC threshold schemes where the real leak was a side-channel in key generation, not the cipher choice โ the danger was never the headline, it was the assumption nobody checked underneath it. Audit reports are promises, not guarantees; press releases are not even promises.
Takeaway
Watch the signals, not the headline. The next genuine factoring record will land in the 840-850 bit band, will ship with polynomials and core-years, and will be announced by IACR-adjacent researchers, not by a crypto aggregator. If "RSA-896" is real, an authoritative body will reproduce it; if it is not, it will quietly rot, which is the standard fate of AI-generated slop. Meanwhile the migration that actually matters โ RSA to post-quantum, ML-KEM and ML-DSA on NIST timelines โ proceeds on a schedule this article never touches.
So before you reprice a single key over this, ask the only question that has ever mattered in this industry: show me the parameters. No NFS artifacts, no record. No reproducible mechanism, no threat. Yield is a function of risk, not just time โ and the risk here was never the cipher. It was the source.