Introducing Devin Security Swarm A more cost effective and accurate way to find security vulnerabilities in complex codebases, based on a new architecture: Agentic MapReduce.

Research, design, and math are three fields that tend to attract obsessives. Few have had a bigger impact on our imagination than legendary creator Grant Sanderson of @3blue1brown. We were lucky to host Grant at our office last week with Cognition's Head of Research @silasalberti and head of Design @josephhhhz for a fireside chat on the craft of making abstract ideas accessible, and how intelligence and design will evolve together. Events like this happen regularly at Cognition - if that sounds interesting you, you might be a great fit for our team. Check out our open careers here: cognition.com/careers

Read the announcement: cognition.com/blog/devin-sec…

Our goal is to help security teams shift from reactive triage to proactively fixing what matters, close the critical gaps scanners miss before they become breaches, and return engineering capacity to the product roadmap. Learn more and enroll today: devin.ai/security-program

Here’s how it works: our engineers embed within your team while Devin sprints through your vulnerability backlog, ingesting reports from scanners you already use, validating each vulnerability, and shipping patches. Then we go beyond your existing backlog, leveraging Security Swarm and Devin Review to help you future-proof your security workflows, continuously catching and remediating new vulnerabilities chained across the codebase.

Frontier models are collapsing the time from vulnerability discovery to exploitation. Findings that were once safe to deprioritize can no longer sit in the backlog. It's time to move from a reactive to proactive security posture.

Building on Devin's new capabilities, today we're announcing the Security Vulnerability Remediation Program: a tailored engagement to take your security backlog towards zero in six weeks. Remediation no longer has to compete with your product roadmap for engineering time.

Try it in Devin! devin.ai

Claude Fable 5 is available in Devin. You can use Fable 5 in Devin Cloud’s Ultra agent, our smartest and most capable agent, which excels at long-horizon tasks and debugging. Claude Fable 5 is also available in Devin Desktop and Devin CLI.

We’re also publishing extensive documentation and technical materials about Agentic MapReduce, including a deep-dive on our evals. Read our announcement: cognition.com/blog/introduci… Learn about Agentic MapReduce: devin.ai/blog/agentic-map-re… Check out the evals: devin.ai/blog/security-swarm…

Security Swarm is a new pillar of Devin for Security: a suite of tools to help you find vulnerabilities, validate their exploitability at runtime, and ship remediation PRs. Learn more and try it today at: devin.ai/security

The result is simultaneously more efficient and more accurate than other tools. We evaluated a variety of security scanning tools on a dataset of 50 GHSA vulnerabilities across 14 languages including Go, Rust, Python, Ruby, Java, C#, JavaScript, C, Swift, Dart, and Elixir. The dataset spans opens source repos of various sizes and of many software categories. Beyond excelling on our eval, Devin Security Swarm also found critical vulnerabilities that other tools missed, like a PHP sandbox bypass via template injection, an argument injection through metadata value parsing, and an overly broad deserialization surface.

We built a new architecture for whole-codebase reasoning that we’re calling Agentic MapReduce. Security scanning is different from most coding tasks: a report is only trustworthy if the whole codebase is considered. But most agentic systems struggle to scale reasoning across large repos. Devin maps relevant signals across the repo, fans out focused agents over bounded shards, reduces their findings into one report, then verifies serious vulnerabilities in isolated sandboxes before marking them confirmed.

In testing, Devin Security Swarm found 36 of 50 real-world GHSA vulnerabilities at 30% lower cost per finding than the next most accurate alternative.

Through Aug 31, Sonnet 5 will use roughly 30% less quota than Sonnet 4.6 in Devin Desktop/CLI. After that, it will use the same quota as Sonnet 4.6. Try it: devin.ai/download

On FrontierCode (Extended), our benchmark for real-world engineering tasks that grades mergeability and quality, Sonnet 5 scores 53.8% and has a 57.6% pass rate (higher than Opus 4.8). Note: These relative rankings may change slightly with coming adjustments to FrontierCode. devin.ai/blog/claude-sonnet-…

Claude Sonnet 5 is now available in Devin Desktop and Devin CLI. Sonnet 5 pairs frontier-level coding performance with a more affordable price point and outperforms Opus 4.8 on FrontierCode Extended.

Watch Devin Fusion work: The sidekick model handles fetching information and skimming sources. The frontier model makes a plan for implementation, then delegates well-scoped sub-tasks to the sidekick with its own cached context.

Devin Fusion is available today in Devin. Try it out: app.devin.ai/signup?source=f…

For more research on how we built Devin Fusion, including examples, check out our blog: cognition.com/blog/devin-fus…