Cognition launches Devin Security 2.0 with Claude Mythos scans

Cognition frames Devin Security 2.0 as a response to a widening gap between attackers and defenders. The body notes that in October 2026, both PHP and Node.js projects disclosed remote code execution vulnerabilities affecting broad swaths of the web, and researchers using frontier models reportedly developed exploits that worked across multiple applications within hours. On the defense side, the volume of findings from AI and other tools keeps growing into a backlog that teams cannot clear. Finding more vulnerabilities alone does not reduce risk; the product's premise is that what matters is judging which findings are truly dangerous in a given environment and completing fixes quickly.

The product stitches together capabilities that enterprises often buy separately: threat modeling done with Cognition's technical team, deep scans using frontier cyber models like Claude Mythos without individual model contracts, ingestion and re-validation of findings from Snyk, Wiz, and bug bounty reports, and autonomous fixes by Devin that can process thousands of findings in parallel. Human review remains in the loop for both final risk decisions and merging fixes, and the recorded rationale is positioned for compliance documentation such as FedRAMP and PCI DSS. The free scan campaign through November 30, 2026, together with the several hundred million dollars in Devin credits, appears designed to pull enterprises into that workflow before they commit.