How many RSA keys have been broken with a quantum computer?

Zero. No RSA key of any deployed size — not RSA-2048, not RSA-1024, not even a toy 64-bit modulus — appears in the public record as having been broken by a quantum computer (public record reviewed 2026-11-02; board below). The largest integer genuinely factored with Shor's algorithm on real quantum hardware is 35 — a six-bit, two-digit number — and the 2019 experiment that holds that ceiling reported success in only ≈14% of runs (Amico et al., PRA 100, 012305, 2019). Both factoring records set in 2026 — RSA-260 in September, RSA-896 sixteen days later — were set by classical GPUs running the general number field sieve, with zero qubits involved (Cognition, 2026-09-09; S. Weis, 2026-09-19). Rosetta Quantum keeps this dossier dated and sourced so a security team can quote the real score to its board — and still plan its migration by the clocks that actually bind.

What is the genuine quantum factoring record?

Thirty-five, at most — and the asterisk matters. The most recent survey of every public result, The State of Factoring on Quantum Computers (Willsch et al., arXiv:2410.14397, v2, May 2025), puts it plainly: on digital quantum computers, "only very small integers N ≤ 35 have been successfully factored" with Shor's algorithm. The dated list is short: 15 on a 7-spin NMR machine (Vandersypen et al., Nature 414, 2001), 21 on a photonic setup with qubit recycling (Martín-López et al., Nature Photonics 6, 2012), 15 again on trapped ions with a Kitaev-style protocol (Monz et al., Science 351, 2016), and the attempt at 35 on IBM's ibmqx5 (Amico et al., PRA 100, 2019) — whose own authors report that the run succeeded about 14% of the time and that, for 35, "the algorithm fails" under accumulated noise. The strictest reading of the record is therefore 21, the last run whose authors claimed success; the most generous is 35. Either way it is a two-digit number, and no new genuine Shor factorization record on hardware has been published since 2019 (per the same review, checked against the record on 2026-11-02).

There is one more measured number worth knowing, because it calibrates everything: the record for simulating Shor's algorithm on classical hardware is a 39-bit integer — 549,755,813,701 — run on 2,048 GPUs of the JUWELS Booster supercomputer (Willsch et al., arXiv:2410.14397). A fleet of 2,048 GPUs can also, as of September 2026, factor an 896-bit RSA modulus classically (next section). The same fleet, asked to emulate a quantum computer running Shor, will top out near 39 bits. That is what an exponential separation looks like from both sides — and why every added qubit of a future fault-tolerant machine will matter, in the future tense (resource estimates for RSA-2048 will be found in our dated refresh of the estimates ladder; they are paper promises, not measurements — see how many qubits would it take to break RSA-2048).

Why don't the headline “quantum factoring” claims count?

Because when you read the fine print, none of them factored anything cryptographically shaped — and the field has known since 2013 exactly how such demonstrations mislead. That year, three IBM researchers published the reductio ad absurdum: a "compiled" Shor circuit that factors arbitrarily large numbers of convenient form in constant time with two qubits (Smolin, Smith and Vargo, arXiv:1301.7007, 2013). Their point, now standard: if you simplify the circuit using prior knowledge of the answer, the size of the number you "factored" measures nothing. The 2025 review applies the same caution even to the canonical 15/21/35 runs: those compiled circuits "might not have been found without previous knowledge about the answer" (arXiv:2410.14397).

The dossier of famous claims, each with its fine print and source:

Two families deserve one more line each. The Schnorr-lattice hybrids (the 2022 claim and successors) have reported factorizations up to ≈100 bits, but the review records that "concerns about the claimed scalability of the approach have been raised" and files it as an open question (arXiv:2410.14397). And the annealing family holds a real measured record — 8,219,999 on a D-Wave machine — whose fine print is arithmetic: 8,219,999 = 251 × 32,749, an unbalanced semiprime whose smaller factor fits in 8 bits; RSA moduli, by construction, have no small factor to find. None of this is an accusation — every row above links its evidence; it is the difference between a measured result and a scalable one.

Who actually broke RSA keys in 2026?

Classical computers — twice, in sixteen days, in September — and conventional attackers, every other day of the year. On 2026-09-03, Eric Lu of Cognition factored RSA-260 (862 bits, 260 digits) with a GPU port of the open-source CADO-NFS sieve built largely by the company's Devin agent: ≈4,900 GPU-days (13.5 GPU-years) on B200/GB200/GB300 GPUs, ≈US$400,000 at market prices, "essentially no algorithmic advancements" by the author's own description (Cognition blog, 2026-09-09; the two 130-digit factors verify by multiplication). Sixteen days later, on 2026-09-19, Stephen Weis published the factors of RSA-896 (896 bits, 270 digits): CADO-NFS ported to GPUs with the Claude model, ≈30 GPU-years on up to 2,048 H100s in ≈10 days of idle datacenter time; the author states the work "did not meaningfully improve" the number field sieve's runtime and "does not impact the security of deployed RSA-2048 keys" (saweis.net, 2026-09-19; the two 135-digit factors verify). His further claim — that RSA-1024 keys will be within reach of actors with datacenter-scale GPU fleets — is his projection, not yet a demonstration; we file it as such.

Both records are classical. Neither moves the quantum score by one bit. And while the headlines of 2026 kept asking about qubits, the largest theft in industry history — ≈US$6,360M from Binance on 2026-10-29 — was executed with conventional key compromise, per the forensic classifications available to date; our piece on what the largest hack in history changes for your security keeps that file. The score that pairs with today's zero broken keys is this one: public breaches attributed to a quantum attack, ever, anywhere: 0 (re-verified 2026-11-02, board below).

If the score is 0 and 0 — why does your migration clock still run?

Because every clock that binds you prices the future, not the present — and says so in writing. Three reasons, each with its number. First, harvest-now-decrypt-later: ciphertext recorded today will be exactly as old as your data's confidentiality lifetime when a capable machine arrives, so for a record that must stay secret 20 years, the relevant date is not Q-Day but Q-Day minus 20 — the Mosca arithmetic we worked through in what is HNDL and what data is at risk today. Second, the regulatory clocks are already final and make no reference to today's capability: NIST IR 8547 (final, 2026-10-27) will deprecate RSA/ECC after 2030 and disallow them after 2035; EO 14412 and OMB M-26-15 set binding US federal dates (PQC key exchange in high-value assets by 2030-12-31, signatures by 2031-12-31); the UK's NCSC timeline runs 2028/2031/2035 — the full map is in when do RSA and ECC actually expire. Third, the capability estimates keep falling on paper — from ≈1M qubits to 22,593 cat qubits in four years of publications — and those are promises in the ochre column, not measurements; the house position on timing, RQ-PRED-QDAY-001 (sealed 2026-10-09: floor 2031, window 2033–2039), is a pre-registered, refutable judgment, not a measurement — see when is Q-Day coming.

What does a CISO do with today's zero? Use it twice. Externally, cite it: a board that has been told "quantum computers are breaking encryption" deserves the measured sentence — none has, ever, publicly, as of 2026-11-02 — followed by the clocks above; precision buys the credibility that panic spends. Internally, sequence by it: the zero means your deadline driver is data lifetime plus regulatory date, not an attacker's demo — so inventory first (a cryptographic bill of materials), migrate key exchange before signatures (the asymmetry measured in which PQC standard your browser already runs), and let the ≈70% of browser traffic already negotiating post-quantum key agreement (Cloudflare, 2026-09-29) remind the budget owner that migration is mainstream engineering now, not speculation — the adoption series is in how much traffic already negotiates PQC.

PQC Board — status as of 2026-11-02

The two zeros and the classical-record series now live in the board as dated rows, so next time a vendor deck or a headline claims otherwise, the delta will be checkable against a timestamped baseline.

What we don't know

• Whether a state actor has factored more in secret. The register we keep is the public one; a capability exercised covertly would not appear in it, and we have seen no evidence either way. We can only measure what is published.
• Where exactly to draw the line for "factored". We count published, verifiable factorizations claimed as successes by their authors; the 2019 run at 35 (≈14% success, called a failure by its own paper) shows the boundary is real, which is why we show both readings (21 strict, 35 generous).
• Whether anyone will publish a verified Shor factorization beyond 35 — and when. Nothing new since 2019 is itself a measured fact, but it will not stay true forever.
• Whether RSA-1024 will fall classically on the timeline Weis projects. His RSA-896 factors verify; his RSA-1024 claim is a projection awaiting a demonstration.
• Whether the contested scaling of the lattice-hybrid and annealing approaches will be formally adjudicated; the 2025 review files the lattice question as open.
• When our own window will be tested: the Q-Day bet (floor 2031, window 2033–2039) is a sealed, refutable judgment with a scheduled review ≈April 2027 — not a measurement, and we will update it against evidence, not headlines.

Rosetta Quantum publishes verdicts with raw, reproducible data and dated sources. This is educational content, not security advice for a specific system — and not a product claim.