Hunt business-logic flaws and open fix PRs
Parallel Devin agents each read part of a codebase, find business-logic and auth bypass flaws, confirm them in a sandbox, then open remediation PRs (vendor description).
What they did
Parallel agents each take a segment of the codebase and reason across files for business-logic flaws, chained auth bypasses and cross-service exploit paths. Devin then combines the findings into full attack paths and reproduces each one in an isolated sandbox. Once a vulnerability is confirmed, it writes the patch and opens a PR for review. Scan profiles can be generated from existing threat model documents.
How it went
On Cognition's own 50-vulnerability benchmark, Devin Security scored 72% recall at $90.23 per run, against 68% for Claude Security at $131.87. This is a vendor benchmark, not an independent one.
Worth knowing
The first full scan sets the baseline. Later scans cover only changed code, so cost falls over time, and batch size per profile controls depth and cost.
Labels
Parallel Devin agents each read part of a codebase, find business-logic and auth bypass flaws, confirm them in a sandbox, then open remediation PRs (vendor description).
Parallel agents each take a segment of the codebase and reason across files for business-logic flaws, chained auth bypasses and cross-service exploit paths.
Devin then combines the findings into full attack paths and reproduces each one in an isolated sandbox. Once a vulnerability is confirmed, it writes the patch and opens a PR for review.
Parallel Devin agents each read part of a codebase, find business-logic and auth bypass flaws, confirm them in a sandbox, then open remediation PRs (vendor description).
The “Material” label failed its quality check and is not used for selection.
Details
- Agents
- Devin
- Source
- other
- Source date
- undated
- Accounts
- 2
- In registry since
- Oct 12, 2026