--- title: Cognition launches Devin Security 2.0 and open-sources a... description: Cognition has launched Devin Security 2.0 and open-sourced a companion agent plugin for security work. The new Devin Security is described as powered by Claude... canonical: https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cognition launches Devin Security 2.0 and open-sources a security agent plugin | daily.dev og:description: Cognition has launched Devin Security 2.0 and open-sourced a companion agent plugin for security work. The new Devin Security is described as powered by Claude... og:url: https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g og:image: https://api.daily.dev/og/posts/5CyeeyA9g.png og:image:alt: Cognition launches Devin Security 2.0 and open-sources a security agent plugin og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cognition launches Devin Security 2.0 and open-sources a security agent plugin **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 1 comments ## Summary Cognition has launched Devin Security 2.0 and open-sourced a companion agent plugin for security work. The new Devin Security is described as powered by Claude Mythos and frontier cyber models, aimed at finding, prioritizing, and fixing vulnerabilities. Jared Palmer called it an 'autonomous defense factory'. Cognition is also offering hundreds of millions of dollars in free credits for enterprises, covering scanning, verification, and remediation. The open-source plugin works with any agent, not just Devin, and terms for who qualifies for the credits haven't been published. ## Content Cognition has released a new version of Devin Security, and it's pairing the launch with an open-source plugin for security work. The company describes the new Devin Security as powered by Claude Mythos and frontier cyber models. Its pitch is that teams are entering what it calls a new dark age of cybersecurity, and that Devin can help them find, prioritize, and fix urgent vulnerabilities. @jaredpalmer calls Devin Security 2.0 an "autonomous defense factory". Cognition is also committing hundreds of millions of dollars in free credits for enterprises. The credits cover scanning, verification, and remediation. ## The open-source plugin Separately, Cognition has open sourced an agent plugin meant to help secure systems against recent cybersecurity threats. It can be installed with any agent, so it isn't tied to Devin, though it can also be used in Devin today. ## What to make of it "Hundreds of millions of dollars" in credits is a big number, though credits are not the same as cash, and the value to a given company depends on how much scanning and fixing it actually needs. Cognition hasn't published terms for who qualifies. Still, putting a free, installable plugin alongside a paid-credit program is a sensible way to get people trying the tooling. ## Questions this post answers ### What is Devin Security 2.0 and what does it do? Devin Security 2.0 is Cognition's updated security offering, described as powered by Claude Mythos and frontier cyber models. It is designed to help teams find, prioritize, and fix urgent vulnerabilities. Jared Palmer described it as an 'autonomous defense factory'. Cognition paired the launch with hundreds of millions of dollars in free credits for enterprises covering scanning, verification, and remediation. _Teams weighing AI-driven vulnerability scanning tools can track launches like this one on daily.dev._ ### Is Cognition's open-source security agent plugin tied to Devin? No, the plugin can be installed with any agent and isn't tied to Devin, though it can also be used within Devin. It was open-sourced to help secure systems against recent cybersecurity threats, alongside the paid Devin Security 2.0 launch. _Developers comparing open security tooling options can follow plugin releases like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 59 comments across x (as of 2026-10-26). **TL;DR:** Reactions mix genuine enthusiasm for the free credits and 'find, prioritize, fix' pitch with repeated skepticism about whether findings actually turn into shipped, verified fixes rather than more alert noise. **Sentiment:** 55% positive · 35% mixed · 10% skeptical **The case for** - The scale of free credits could effectively hand small teams a security function they couldn't otherwise afford. - The dedupe/re-verification of stale scanner findings is seen as a genuinely useful, underrated feature. - Combining discovery with drafted fixes is viewed as the real value-add over typical scanners. **The pushback** - Many doubt that finding vulnerabilities was ever the hard part; the real bottleneck is getting fixes actually merged and verified. - Concerns that automated patches might silently break edge-case behavior or skip blast-radius analysis. - Some see the launch timing (alongside unrelated security/IPO news) as opportunistic or hypocritical marketing. - Worry about false-positive rates and whether humans will actually confirm flagged bugs before trusting the tool. **By community** - x (mixed): Replies swing between excitement about the credits and fix-oriented workflow, and pointed questions about whether fixes actually ship versus just generating more findings. **Hottest debate:** Whether the real bottleneck security teams face is finding vulnerabilities at all, or actually getting fixes verified and merged. **Open questions** - What share of flagged bugs get confirmed by a human versus dismissed as false positives? - Will credit access extend to smaller teams/builders, or stay enterprise-only? - How does the system rank urgency: by exploitability or by blast radius? - How does it handle legacy/decades-old industrial code that can't easily be patched? **Highlights** > @cognition most backlogs die at step 4, finding the vulnerabilities was never the hard part > — [devil9614\_ on x · 1 points](https://x.com/devil9614_/status/2114762260933730310) > @cognition The quietest line in the thread is the most useful one: re-checking findings from existing scanners against current code and deduping. A large share of any scanner backlog is stale; an agent that retires the stale share is worth more than one that finds a few percent more. > — [SplinInstinct on x](https://x.com/SplinInstinct/status/2114750043999625726) > @jaredpalmer Free scanning credits are generous until the report lands with four thousand findings. Triage is where security tools earn their keep. > — [overshadowed\_x on x](https://x.com/overshadowed_x/status/2114788225319665925) > @cognition Finding and drafting fixes is a good use of agents. The tricky part at scale is verifying that automated patches don't silently alter edge-case behavior in production. > — [JohnKocdr on x](https://x.com/JohnKocdr/status/2114754364548292623) > @cognition I disagree with the timing here! Selling a security product powered by Claude on the exact day we learn a months old startup walked into Anthropic internal systems through ordinary office software is a bold sales strategy > — [eforus\_overseer on x](https://x.com/eforus_overseer/status/2114750736701804826) **Source threads** - [x](https://x.com/cognition/status/2114741368627335379) · 0 points · 57 comments - [x](https://x.com/jaredpalmer/status/2114750416852537544) · 0 points · 2 comments ## Community discussion Top comments from developers on daily.dev. **@laouadirabah** · 0 upvotes > The interesting part isn’t the “autonomous defense” label, it’s whether findings come with reproducible evidence and safe remediation boundaries. > > Security agents get useful fast once they can prove why something is exploitable without turning automated fixes into another source of risk. ## Similar posts on daily.dev - [Devin by Cognition: The first AI software engineer](https://daily.dev/posts/devin-by-cognition-the-first-ai-software-engineer-ffqteevrz) · Product Hunt · 1 upvotes · 0 comments - [Cognition helps Devin test its own work with GPT‑6 Astra](https://daily.dev/posts/cognition-helps-devin-test-its-own-work-with-gpt-6-astra-f6g2gx2wt) · OpenAI · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#claude](https://daily.dev/tags/claude), [#devin](https://daily.dev/tags/devin) [View this post on daily.dev](https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cognition launches Devin Security 2.0 and open-sources a security agent plugin","url":"https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g"},"datePublished":"2026-10-26T16:06:26.639Z","dateModified":"2026-10-26T19:07:21.715Z","description":"Cognition has launched Devin Security 2.0 and open-sourced a companion agent plugin for security work. The new Devin Security is described as powered by Claude...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,claude,devin","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Cognition launches Devin Security 2.0 and open-sources a security agent plugin"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g","comment":[{"@type":"Comment","text":"The interesting part isn’t the “autonomous defense” label, it’s whether findings come with reproducible evidence and safe remediation boundaries.\nSecurity agents get useful fast once they can prove why something is exploitable without turning automated fixes into another source of risk.","datePublished":"2026-10-26T16:13:17.667Z","url":"https://daily.dev/posts/5CyeeyA9g#c-YPB2S0sr2","author":{"@type":"Person","name":"Laouadi Rabah","url":"https://daily.dev/laouadirabah","image":"https://avatars.githubusercontent.com/u/297700963?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cognition-launches-devin-security-2-0-and-open-sources-a-security-agent-plugin-5cyeeya9g#faq","mainEntity":[{"@type":"Question","name":"What is Devin Security 2.0 and what does it do?","acceptedAnswer":{"@type":"Answer","text":"Devin Security 2.0 is Cognition's updated security offering, described as powered by Claude Mythos and frontier cyber models. It is designed to help teams find, prioritize, and fix urgent vulnerabilities. Jared Palmer described it as an 'autonomous defense factory'. Cognition paired the launch with hundreds of millions of dollars in free credits for enterprises covering scanning, verification, and remediation. Teams weighing AI-driven vulnerability scanning tools can track launches like this one on daily.dev."}},{"@type":"Question","name":"Is Cognition's open-source security agent plugin tied to Devin?","acceptedAnswer":{"@type":"Answer","text":"No, the plugin can be installed with any agent and isn't tied to Devin, though it can also be used within Devin. It was open-sourced to help secure systems against recent cybersecurity threats, alongside the paid Devin Security 2.0 launch. Developers comparing open security tooling options can follow plugin releases like this on daily.dev."}}]} ```