Cognition Updates Devin Security With Claude Mythos and Hundreds of Millions in Credits

Cognition, the company behind the Devin coding agent, has launched two initiatives for security teams at once. The first is a major update to Devin Security, its product for end-to-end vulnerability discovery, prioritization, and remediation: it now includes deep scans on Claude Mythos and other frontier cyber models. The second is a pledge to put hundreds of millions of dollars into Devin credits, so that enterprises can scan their code for free and close the most dangerous holes before attackers find them.

The pitch is simple. AI makes sophisticated attacks cheaper and shrinks defenders' response time, while security teams already have more findings than engineers who can fix them. Classic scanners assign severity without knowing the codebase, how it is deployed, or what protections are already in place. They overrate some risks and underrate others, and compliance deadlines keep ticking regardless. Engineers waste time on dubious findings and cannot tell what is actually on fire.

The threat model as a shared document

At the core of Devin Security is a "living" threat model that the product builds together with security and development teams. It describes systems, services, and hosts, how they interact, network policies and security groups, how code is deployed, and which code is not used at all. A human fills in what cannot be inferred from the code, such as which region a service runs in or whether it sits inside the perimeter. Devin also asks about business consequences: what happens if one user reads another's data, gains admin rights, or starts using the product for free. Those answers go into the model too and change as the system evolves.

Scans, investigations, and fixes all run against this model. Deep scans target complex exploit chains in large codebases. The product is model-neutral: Cognition is building a single managed service that can plug in the best cyber models from different labs and swap them as the field develops. Devin also pulls in findings via API from existing scanners, bug bounty programs, and advisories, removes duplicates, and re-verifies them with frontier models.

Four ways to close a finding

Next, Devin re-rates each finding, its own or someone else's, by exploitability and potential damage in the specific environment. The team sees what to fix now, what can be scheduled, and where a documented risk adjustment is appropriate. Closing a finding does not always mean a pull request. There are four options:

• Reclassification with evidence. Devin documents false positives or proposes a risk adjustment based on reachability, access controls, and other mitigating factors, and prepares risk-acceptance records. Every proposal requires human approval, and the original CVSS score stays next to the edit. Vulnerabilities in the KEV catalog are never reclassified.
• Infrastructure mitigation. With the right permissions configured, Devin applies a WAF rule, changes a security group, or closes public access to a service. Exposure drops while a permanent fix is prepared, but the vulnerability itself remains.
• Vulnerability fix. Devin launches thousands of parallel sessions in independent virtual machines. Each one reproduces the vulnerability, writes a fix, runs the reproduction test and the existing tests, and opens a PR with evidence.
• Vulnerability class elimination. For recurring defects, Devin assesses and helps implement a broader refactoring, for example centralizing authorization checks or parameterizing queries across the whole application.

Results flow back into existing security tools, and supporting records can be exported to POA&M and GRC systems.

Cloud agents and hundreds of millions in credits

The technical foundation is Devin's cloud architecture. For more than two years, it has been doing engineering work in parallel, with each session getting its own virtual machine to reproduce the problem, make changes, and verify them independently. Because of this, Cognition says it can run thousands of scans and fixes at once, on real services rather than through static analysis.

On the financial side, current and future enterprise customers get free scans with frontier cyber models. New customers can also receive credits to remediate their most critical vulnerabilities. The Cognition team promises to work alongside customers during investigation and remediation.

For security leads, the takeaway is practical. Before adopting a tool like this, assess whether your team is ready to maintain a shared threat model: prioritization quality depends on the context that people provide. It helps to decide up front which classes of changes are allowed without review and which require approval, and to give Devin exactly the infrastructure permissions you are prepared to trust it with. The free scans offer a low-cost way to compare its findings with the output of your current scanners before letting automated fixes into production.