From Detected Flaws to Patches, Devin Automates Vulnerability Response

With Devin Security 2.0, Cognition pairs Claude Mythos with agents capable of analyzing, prioritizing, and fixing software vulnerabilities.

356 security reports received by the curl project in less than ten months, compared to 181 for the entire previous year. The acceleration of vulnerability discovery, driven by artificial intelligence models, highlights a problem: cybersecurity teams can now receive potential flaws faster than they are able to examine and patch them.

It is on this mismatch that Cognition positions Devin Security 2.0, an evolution of its software development agent. The system combines specialized cybersecurity models, including Anthropic's Claude Mythos, with agents capable of analyzing code repositories, verifying reported vulnerabilities, assessing their danger in a given environment, and preparing tested patches. The company simultaneously announced several hundred million dollars in Devin credits to support organizations in these operations. Vulnerability discovery outpaces processing capacity

Language models capable of analyzing code have changed the conditions of cybersecurity research. A flaw that is difficult to exploit, previously classified as secondary, can become much more concerning if an automated system manages to quickly identify its exploitation conditions.

Cognition takes the example of vulnerabilities disclosed in the PHP and Node.js ecosystems, where the shift from a known weakness to a demonstrable exploit can abruptly alter technical teams' priorities.

However, the problem is not limited to newly discovered flaws. Companies are already accumulating alerts from scanners, bug bounty programs, audits, and internal teams. Multiplying these reports without increasing verification and remediation capacity primarily risks shifting the workload onto the developers tasked with addressing them.

The data cited for curl illustrates this pressure. The project received 356 security reports as of October 22, 2026, compared to 181 for all of 2025, representing nearly double in less than ten months. These are received reports, not necessarily 356 confirmed vulnerabilities.

Devin Security aims to bring together the operations that follow this initial detection: verifying that a flaw still exists, determining its actual exposure, reproducing it, and proposing a patch. Claude Mythos joins Devin's analysis tools

Devin Security's deep analyses can now use Claude Mythos and other advanced models specialized in vulnerability research.

These capabilities are integrated into Cognition's environment. Enterprise customers can thus leverage them without having to separately obtain direct access to each cybersecurity model.

This approach relies on an architecture called Agentic MapReduce, which distributes the analysis of a software repository across multiple agents.

The system begins by mapping security-critical areas: application routes, authorization controls, data access, sensitive operations, or functions likely to process untrusted content. It then selects the relevant code sections and launches several parallel investigations.

The results are aggregated to deduplicate findings, correlate flaws that could form an exploit chain, and select those that warrant further verification.

For high-priority reports, Devin can launch a functional version of the application in an isolated environment to test whether the vulnerable behavior can actually be reproduced.

Using multiple models allows Cognition to adapt analyses to specific tasks and difficulty levels, rather than relying on a single system. A flaw critical on paper is not always critical in the application

The other challenge concerns vulnerability prioritization. A technical severity score is not enough to describe the concrete consequences of a flaw within an enterprise.

A vulnerable component may be inaccessible from the Internet, protected by multiple authentication mechanisms, or located in a part of the code that is no longer executed. Conversely, a weakness deemed relatively modest can become severe if it allows access to other customers' information or bypasses authorizations.

To address this, Devin Security builds an evolving threat model alongside technical teams. It documents services, machines, network rules, data flows, trust boundaries, and actual deployment conditions.

Some information can be extracted from the code or infrastructure. Other details, such as the scope of an internal service or the business impact of unauthorized access, require human input.

Data published in Anthropic's work on Project Glasswing illustrates this distinction: out of 1,752 reports initially considered high or critical that were reviewed, 90.6% corresponded to real vulnerabilities, but only 62.4% were ultimately confirmed as high or critical.

Discovering a real flaw and assigning it the correct level of urgency are therefore two distinct operations.

Cognition specifies that Devin preserves the original CVSS score when proposing an environment-adjusted priority. Risk adjustments require human validation, and vulnerabilities listed in CISA's KEV catalog, dedicated to actively exploited flaws, cannot be downgraded by the system. Hundreds of fixes executed in parallel

Analysis is only one part of Devin Security's operation. Once flaws are selected, the agent can prepare their remediation by leveraging multiple independent environments.

Each session has its own virtual machine. Devin reproduces the issue there, modifies the code, runs reproduction tests and pre-existing project tests, and then opens a pull request accompanied by the necessary context for review.

Cognition claims the ability to run thousands of parallel sessions to handle large volumes of reports. This capacity describes its platform architecture; the company does not provide, in this announcement, an independent benchmark establishing a successful remediation rate at this scale.

The system can also ingest reports from external scanners, bug bounty programs, and legacy security reports. It compares them against the current codebase, checks for duplicates, and verifies whether an existing patch or mitigation has already