Most people mistake speed for velocity. They are wrong. In cryptography, most people mistake a headline for a fact. That error is more expensive than any bug I have ever found in a smart contract.
Last week, a crypto news outlet published what should have been one of the most consequential stories in computational number theory in decades: RSA-896, an 896-bit semiprime, had been factored with AI assistance. The public record, the article claimed, now stood at 896 bits.
I read the article. Then I read the underlying source. Then I read the absence of a source.
There were no polynomials. No sieving parameters. No matrix dimensions. No core-years. No replication. No institution. No named AI system. Nothing but a conclusion wrapped in a buzzword and dressed in security panic. The source field for the central claim read, simply, "unknown."
I have spent a decade inside this industry. I have audited forty thousand lines of Solidity in a single engagement. I have signed off on risk models only after they survived historical stress tests. I have learned the difference between an audit trail and an assertion. This claim has no trail. That is not a breakthrough; it is a template for AI-generated disinformation.
The Record, As It Actually Stands
Let me establish the baseline before we examine the anomaly.
The public factorization record for general semiprimes — numbers with exactly two large prime factors of similar size, the kind underlying RSA — has been maintained through academic and volunteer effort for two decades. The milestones are documented and reproducible:
- RSA-768 (768 bits, 232 decimal digits): factored in 2009 by a collaboration of INRIA, EPFL, NTT, and others. The sieving ran for roughly two years across many clusters.
- RSA-240 (795 bits, 240 digits): factored in December 2019. The full parameters were disclosed in a paper by Boudot, Gaudry, Guillevic, Heninger, Thomé, and Zimmermann.
- RSA-250 (829 bits, 250 digits): factored in February 2020 by the same team. Again, full disclosure: polynomials, sieving ranges, software versions, hardware, core-hours, and matrix dimensions.
That is the complete modern public record. RSA-896 is not on it.
The RSA Laboratories challenge series — the same series that designated "RSA-896" for a specific 270-digit number — was terminated in 2007. RSA Labs withdrew the prizes and stopped tracking the contest. Since then, the field advanced through academic coordination, not a commercial ladder. To claim "RSA-896 has been factored" is to claim that an unclaimed retired benchmark has fallen while the real record progressed only eleven bits in its last major advance. A jump from 829 bits to 896 bits is a 67-bit leap. No one makes that leap in one anonymous press release.
The Physics of the Claim
Factorizations at this scale are not the product of clever mathematics alone. They are industrial projects with a precise cost structure.
The General Number Field Sieve (GNFS) proceeds in four phases. First, polynomial selection: choose two polynomials, say f and g, that share a common root modulo the target integer n. This is a search problem with an enormous search space; it is the phase most amenable to heuristic improvement, including, in theory, machine learning.
Second, sieving: for each of a massive range of integers, test whether the values of f and g factor into small primes. When both factor, you have found a relation. Smoothness probability determines how many relations you need and how much computation you burn to find them. This phase dominates the total cost.
Third, filtering and linear algebra: the collected relations form a sparse matrix with hundreds of millions of rows and columns. The matrix is solved over a finite field using block Lanczos or Wiedemann algorithms. This step alone uses thousands of gigabytes of distributed memory for months.
Fourth, the square root: a delicate reconstruction step that finally yields the two prime factors.
Every honest record announcement describes all four phases with concrete numbers. For RSA-250, the sieving ran roughly ten months, and the total compute is measured in thousands of core-years. The team disclosed the software stack, the cluster architecture, the storage volume, and the wall-clock time of each phase.
A naive extrapolation from the heuristic complexity L_n[1/3, 1.923] puts the ratio of difficulty between 896 bits and 829 bits at roughly seven to eight. In other words, an 896-bit factorization demands tens of thousands of core-years and a linear algebra problem at the extreme edge of what any distributed cluster can hold. This is national-laboratory territory. It is not a weekend hobby. It is not one "AI run" in an afternoon.
The article is silent on all of it. No polynomial, no sieve region, no matrix size, no cluster description, no timeline. Silence at this scale is not humility; it is a confession.
The AI Claim, Under Audit
The crux is this: there is no known mechanism by which machine learning provides an order-of-magnitude speedup to GNFS at record sizes. Not one.
Machine learning could plausibly assist in three spots: guiding polynomial selection by scoring candidate polynomials, tuning sieve parameters, or filtering obvious non-relations. Each of these is an engineering refinement that may shave single-digit percentages off the total cost. None changes the asymptotic structure of the sieve, because the asymptotic structure is governed by smoothness probability — a number-theoretic fact, not a statistical regularity that a network can learn around.
If a genuinely new method existed that factors semiprimes asymptotically faster than GNFS, it would be one of the largest mathematical results of the century. It would arrive with a proof or, at minimum, a detailed computational whitepaper. It would be submitted to IACR venues. It would not appear as a one-line claim in a crypto news roundup with no named authors, no replication, and no preprint.
There is also a recurring unit-confusion that must be named. An 896-bit number is approximately 270 decimal digits. An "896-digit" number, by contrast, would be about 2,977 bits. These two quantities differ by more than three thousand bits of difficulty. Press reports have conflated "bits" with "decimal digits" before, with predictable damage. The article does not explicitly make this error, but it also does nothing to clarify which quantity it means. When a singularly important claim is mathematically ambiguous, the default assumption should be skepticism, not charity.
In my current work — building privacy-preserving data marketplaces for AI training, using zero-knowledge proofs to allow data providers to retain ownership while models learn from anonymized datasets — I am held to a different standard entirely. If I tell a partner that a zero-knowledge proof protects their data, they ask which proof system, which circuit, which trusted setup, which audit. No serious counterparty accepts "proof exists, trust me." The same standard should apply to a claim that a decade-old RSA challenge number has fallen.
A Familiar Pattern
The phrase "AI assistance" sits at the center of the claim, and it deserves scrutiny.
In 2021, while leading a metadata integrity audit for an NFT marketplace, my team examined fifty thousand collections to test how they stored their image and metadata files. We found that thirty percent relied on single points of failure: one pinning service, one gateway, one centralized assumption. Every vendor in that market claimed "decentralized." Very few had a storage-proof or a backup policy that survived inspection. The word "decentralized" was doing rhetorical work that the facts did not support.
"AI-assisted" is doing the same work here.
The AI-for-science field has achieved real results: AlphaProof and FunSearch have produced publishable findings in mathematics and combinatorial search. Those findings are credible for the same reason any scientific finding is credible: they are written down, peer-reviewed, and replicated. No one has to take "AI discovered a new theorem" on faith, because there is a paper.
This claim has no paper. It has no substance. It has a subject-verb-object skeleton and a source marked "unknown."
There is a reason extraordinary claims require extraordinary evidence: the informational cost of a false positive is larger than the cost of no claim at all. Every reader who believes "RSA is now breakable" will spend attention on unnecessary panic. Some may make real decisions — moving funds, changing infrastructure, recommending products to clients — based on a fabrication. The expected damage of a false alarm dwarfs the damage of missing an unimportant milestone.
The Cost of the False Narrative
Let us apply a rule from my risk-audit days: panic is conserved in a closed system. If a false security panic consumes the industry's attention, it drains the exact attention that genuine security work requires.
The real challenge facing the industry right now is post-quantum migration. NIST has standardized ML-KEM, ML-DSA, SLH-DSA, and FN-DSA. Enterprises are still procrastinating on replacing RSA in TLS, code signing, DNSSEC, and legacy hardware trust anchors. The logistics of that migration span a decade and involve every sector of the economy. There is a concrete known threat: harvest-now, decrypt-later. A sufficiently large quantum computer, armed with Shor's algorithm, will decrypt today's recorded traffic retroactively. That is the true RSA endgame. It is not a 67-bit advance in classical factoring; it is the complete collapse of the trapdoor functions on which RSA depends.
For blockchain specifically, the practical impact is near zero: almost every modern chain signs transactions with elliptic curve keys — secp256k1, ed25519 — and does not rely on RSA at all. The panic, if it spreads, is not a panic about chain security; it is a panic about vibes.
Even if the claim were true, RSA-2048 — the actual deployed standard — sits roughly ten orders of magnitude higher on the same difficulty curve. The gap between this alleged record and a usable break is not a stretch; it is a chasm.
A false claim that "RSA-896 was factored" does not accelerate the migration to post-quantum cryptography. It poisons the well. When a genuine emergency arrives — and it will, at some point, perhaps in the form of the first actual Shor-style factorization of a real key — the audience will have been trained by years of fake headlines to hesitate. Hesitation in a migration window is expensive.
I have seen the same dynamic in DeFi. In the 2022 bear market, several lending protocols collapsed because they changed collateralization rules ad hoc in response to oracle manipulation and panic. My team, by contrast, enforced the ratios we had stress-tested before the crisis. The protocols that followed pre-committed frameworks survived the shake; the ones that improvised did not. In the crash, only the audited survive the shake.
Information markets behave the same way. The protocols that preselect their sources of truth — the ones that check parameters, names, and replication before reacting — will survive the next wave of AI-generated security fiction. The ones that react to every plausible headline will be liquidated in the information market.
Who Profits From Confusion?
Follow the incentive.
The article was published by a crypto-focused news outlet. The source of the central claim was "unknown." There is no named researcher, no laboratory, no university, no preprint server. That is not an oversight; it is a signature.
Three explanations fit the available evidence.
First, the piece may be AI-generated content. The pattern is now familiar: an attention-grabbing headline, a vague reference to "AI assistance," zero technical parameters, and an implicit suggestion that readers should "re-evaluate their security assumptions." The design objective is engagement, not accuracy. In a bull market, engagement converts to traffic, and traffic converts to advertising and token narrative.
Second, it may be a severe misreading of a small demonstration. Several research groups have shown that machine learning methods can factor numbers specially constructed for the experiment or small enough to be analytically tractable — usually 50 to 100 bits. Those experiments are interesting; they are also categorically irrelevant to an 896-bit semiprime. A sloppy editor could inflate one of those demonstrations into a record claim by omitting the size, the construction, and the context.
Third, it may be deliberate narrative construction. "AI breaks RSA" combines three proven attention triggers: artificial intelligence, broken cryptography, and imminent doom. The fact that it is false does not reduce its virality. In fact, falsehood often increases virality, because it is designed to be shared before verification.
I cannot assign probabilities among these three explanations with the data available. That is itself the finding. A credible security claim should not leave its readers guessing between incompetence, confusion, and manipulation.
This also belongs to a broader pattern that I have documented for years: attention is the liquidity mining of the news economy. Projects subsidize TVL with APY, and when incentives stop, users vanish. Outlets subsidize attention with alarming headlines, and when verification starts, readers vanish. In both cases, the metric that matters — genuine utility, genuine truth — is the last thing anyone measures.
The Five-Question Filter
Because the ecosystem cannot rely on every outlet to do its own due diligence, I propose a filter. I have used a version of this since my Istanbul audit years, and it has never failed me.
One: What is the mechanism? Which algorithm, which phase, which mathematical insight? If the answer reduces to "AI did it" with no specificity, stop reading.
Two: What are the parameters? Polynomials, sieve region, matrix size, core-years, wall-clock time, hardware. If none are provided, there is no computation.
Three: Who is the actor? Named researchers, institutions, preprints, peer review. An unknown source is not a source.
Four: Who replicated it? Independent verification is the cornerstone of cryptographic truth.
Five: Who profits? Does the claim serve a product, a migration narrative, a panic-driven asset flow, or a click economy?
Run the filter on the RSA-896 story. Every question fails. That is not a coincidence; it is the statistical fingerprint of fabricated or generated content.
A Prediction, Written Down
I will now make a prediction, precisely phrased so that it can be falsified:
The next genuine public record for factoring a general semiprime will land in the range of 840 to 850 bits. It will come from a known academic collaboration. It will include full GNFS parameters, a reported compute budget, and a paper on the IACR preprint server. It will not be announced first in a crypto news aggregator. If AI is involved at all, its role will be marginal and disclosed in one specific phase, not as an "AI breakthrough."
I expect this record will arrive between 2025 and 2028. If a verified 896-bit factorization occurs before 2028, I will update my model publicly and correct this article. That is how you treat an intellectual claim: expose it to be tested.
I have made falsifiable predictions before. For example, I have argued that the blob space created in the post-Dencun world will be saturated within two years, after which rollup gas fees will double again. That is a claim anchored to data and open to disproof. It is the same standard I am applying here.
Meanwhile, the public record remains exactly what it was in 2020: RSA-250, 829 bits, factored by Boudot, Gaudry, Guillevic, Heninger, Thomé, and Zimmermann. No AI was required. No "unknown" source was cited. All the evidence was public then, and it is public now. History is the only consensus that never forks.
The Real Infrastructure Is Trust
The blockchain ecosystem has an almost religious commitment to verification when it comes to money. We demand cryptographic signatures for every transaction, Merkle proofs for every state, and audited code for every contract. Yet the same ecosystem consumes security news the way a market consumes rumors: without verifying the counterparty, the commitment, or the settlement.
That asymmetry is dangerous.
Cryptographic truth has a property that market narratives lack: it accumulates. Every legitimate factorization record extends a chain of reproducible facts. Fake stories degrade the chain by inserting false data points that readers must later unlearn. Unlearning is expensive. It is much harder to undo a belief than to never acquire it.
An image is fleeting; its hash is the truth. A headline is fleeting; its archive is the truth. When someone tells you that a foundational cryptographic assumption has changed, ask for the archive. Ask for the receipt. Trust is not a feature; it is an archived receipt.
Rehearsing for the Real Event
Let me end on a contrarian note that the fake story does not deserve, but that the ecosystem still needs.
Even a fabricated security scare has strategic value if you treat it as a rehearsal.
Consider what the RSA-896 episode just taught us. Media outlets will amplify unverified claims without technical review. Readers will share them faster than they can verify them. "AI assistance" functions as a trust multiplier even when no details accompany it. A single anonymous blog post can force the entire industry to re-litigate fundamental security assumptions.
That is precisely the information environment we will face when the real quantum threat materializes. At some point — plausibly within fifteen years, possibly sooner — a large quantum computer will factor an RSA key of practical size using Shor's algorithm and its successors. On that day, every enterprise with recorded traffic will discover that "harvest-now, decrypt-later" was not a theoretical concern. The migration to post-quantum cryptography will become an emergency.
If the ecosystem has been trained by a year or two of fake "RSA is broken" headlines, the real announcement may meet skepticism. It may be dismissed as another clickbait story. That delay will cost enormously.
So use this fake story as a drill. Institutionalize the five-question filter. Pre-commit to your trusted sources: IACR papers, NIST guidance, named researchers, reproducible artifacts. Decide today whom you will believe.
The question is not whether the RSA-896 claim is true. It is not. The question is whether we are building the verification infrastructure to survive the moment when a true claim actually appears.
Takeaway
The RSA-896 claim fails every test a legitimate cryptographic result must pass: no mechanism, no parameters, no source, no replication, and a comfortable distance between the headline and the math. Do not change a security policy because of it. Do not move funds because of it. Do not let it distract you from the real migration that deserves your attention: replacing RSA with post-quantum cryptography before the quantum clock runs out.
The record stands at RSA-250. The next real record, when it arrives at 840-something bits, will come with polynomials, parameters, and names. Read the archive, not the headline. Verify first, and if you cannot verify, treat the headline as a test, not a fact.
Trust is not a feature; it is an archived receipt.