From finding to fixing
Cognition, the U.S. maker of the AI programmer "Devin," on Oct. 26 (Oct. 27 Japan time) revamped "Devin Security," which deals with software vulnerabilities. It handles the whole process of finding vulnerabilities, prioritizing them and fixing them. The company's X account @cognition announced it.
It uses frontier models strong in offense and defense, such as Anthropic's "Claude Mythos," a model for cyber defense. It searches deeply in large codebases, even for attack paths that chain multiple flaws together. Flaws it finds are rescored based on whether they can actually be exploited in the customer's environment. Working with customers' security and development staff, it also builds a "living threat model" that maps out what needs protecting and the threats.
Four ways to fix
There are four ways to fix issues. They are reclassifying a finding as a false positive with supporting evidence, blocking it on the infrastructure side with measures such as web application firewall rules, building fixes in parallel on virtual machines and submitting proposed changes, and larger rewrites. Classifying a finding as a false positive requires human approval.
Hundreds of millions of dollars in usage credits
Cognition said it would set aside hundreds of millions of dollars in Devin usage credits. Existing and new enterprise customers can receive scans using frontier models for free, and new customers will also get credits for fixes. The credits are not cash, and the company has not given an overall cap, an expiration date or the amount per company. Companies can use these capabilities through Devin even without their own access to Mythos, according to Cognition.
The company has not given figures on accuracy or cost, nor named any customers. Mythos is Anthropic's most capable model, which it offers only to select organizations. Some have pointed out that the name of the next version, "Mythos 5.5," has appeared on the official website.
