Devin hunts bugs with Mythos in 4 steps

Cognition launched a new Devin Security on the 26th of October 2026, the company announced on X. Its AI agent Devin now hunts for bugs with Claude Mythos, an Anthropic AI model with limited access, in 4 steps.

Devin is an AI agent that writes code. Cognition said it is adding "hundreds of millions of dollars" of credits so companies can scan for free.

The 4 steps

First, Devin builds a threat model with the team, meaning a map of what attackers could hit. Then it scans the code with Mythos and other security AI models.

Next, it ranks each flaw by how easy it is to attack in that company's setup. Last, it copies the flaw, writes a fix and tests it.

Each fix runs in its own virtual machine, a sealed computer inside a computer, Devin's blog said. It ends in a pull request, a code change that people review.

Why Cognition says it matters

Devin's blog points to curl, a free tool used to move data across the internet. Curl got 356 security reports in 2026 up to the 22nd of October, against 181 in all of 2025.

The blog also cites an Anthropic review of 1,752 serious findings. It found 90.6 percent were real flaws, but only 62.4 percent were as serious as first rated.

Below we break down the numbers

Curl's 356 reports came in under 10 months, almost double the 181 of 2025. That is about 37 reports a month, against about 15 a month in 2025, by our arithmetic.

What is confirmed and what is not

Cognition gave no price for Devin Security. It did not say how many companies get the free scans.

Key facts

Cognition launched the new Devin Security on the 26th of October 2026.

It scans code with Claude Mythos and other security AI models.

Each fix runs in its own virtual machine and ends in a pull request.

Cognition is giving credits worth hundreds of millions of dollars.