Cognition brings Claude Mythos to enterprises through Devin and pledges hundreds of millions in credits

Cognition, the company behind the coding agent Devin, is giving enterprise customers access to Anthropic's security model Claude Mythos through an upgraded version of Devin Security. The company is also committing "hundreds of millions of dollars" in Devin credits to free vulnerability scans and help with fixes. The announcement went out on Monday, October 26, at 09:00 Pacific time.

According to Cognition, this means companies can run deep scans with Claude Mythos and other frontier cyber models without holding their own access to those models.

What Cognition is launching

Devin Security is Cognition's product for finding, prioritizing and fixing software vulnerabilities. The headline addition is deep scans, designed to uncover complex, chained exploits across large codebases. Cognition says the scans are now powered by "Claude Mythos and other frontier cyber models", and that enterprises can use them through Devin "without needing separate access to the models".

The company calls the product model-neutral: it plans to pick the best cyber-capable models across labs for the job and switch as models improve. The announcement does not say which other models are used today.

Devin can also ingest findings from a customer's existing scanners, bug bounty programs and advisories, remove duplicates and re-verify the findings with frontier models.

A threat model instead of generic severity scores

Cognition criticizes tools that assign severity ratings without understanding the codebase, how it is deployed or which defenses are already in place. Devin Security instead builds a living threat model with the customer's security and engineering teams. It maps systems, services and network policies, and the team adds context Devin cannot read from code, such as whether a service is internal-only.

Findings are then re-scored based on exploitability and potential damage in that specific environment. Devin can propose downgrading or dismissing findings with evidence, but every proposal requires human approval and the original CVSS score stays alongside any adjustment. Vulnerabilities on CISA's KEV list of known exploited vulnerabilities are never relabeled, the company says.

From finding to fix

With access configured, Devin can also apply temporary infrastructure mitigations, such as a WAF rule, a security group change or removing public access to a service. Cognition stresses that the underlying flaw stays open in that case.

For permanent fixes, the company says Devin can run thousands of parallel sessions, each in its own virtual machine. Each session reproduces the vulnerability, writes a fix, runs tests and opens a pull request with evidence. Results can sync back to existing security tools and be exported to GRC tools.

The credits apply to current and future enterprise customers, who get free scans with frontier cyber models. New customers can also receive remediation credits. Cognition does not say how the total will be split, how much each customer can receive, or what the service costs afterwards.

What leaders should take away

Access to the strongest security models now also runs through intermediaries. That can widen access, but it places source code, threat models and infrastructure permissions with one more vendor. Clarify where data is processed, which models are actually used and what rights the agent gets in production.

Free scans can give a quick picture of your own vulnerabilities. Make sure there is capacity and clear ownership to act on the findings, and that human approval is required before findings are dismissed or changes go live.

Sources and media

• Cognition: Devin Security: Find and fix your most dangerous vulnerabilities

Cognition's post was published on October 26, 2026 at 09:00 Pacific time (17:00 Oslo time). All details and quotes in this article come from that post.

Illustration: AI-generated with Grok Bot / hogby.ai