Breaking

Cognition Adds Automatic PR Vulnerability Detection to Devin Review

June 18, 2026 at 12:44 EDT

Software Dev & Coding
AI Agents
Security

Cognition AI said on June 18, 2026, that it has made security review a standard part of "Devin Review," the code-review feature of its AI software engineer Devin. Whenever a pull request (PR) is opened, Devin automatically finds vulnerabilities that static scanners miss, explains each one, and drafts a fix.

Cognition AI · Devin Review

Security review now fires on every pull request

Opening a PR auto-triggers a full-codebase analysis that flags the business-logic flaws pattern-matching scanners miss — authentication bypass, privilege escalation, exposed secrets — then explains each finding and drafts the fix.

34→67%

PR merge rate

~4×

Faster issue resolution

50→80%+

Test coverage range

Per-item security fix

30 minutes by a human → 1.5 minutes by Devin (20× faster)

30 min

Human

→

1.5 min

Devin

One org spent 5–10% of developer time on security work — Devin cut that sharply.

What happens when a PR opens

PR created

Parses code changes

→

Surface flaws

CWE + severity, chained across modules

→

Explain + fix

Drafts the patch in full context

Developer praise

"Caught things other reviews missed"
"First review LLM bot that doesn't feel like slop"
Strong on AI-generated code and large PRs

Caveats noted

Not fully automated — keep human final review
Compute (ACU) consumption must be managed
Standalone large-scale adoption still early

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.