On July 1, 2026, Cognition unveiled Devin Security Swarm, a new capability to find, verify and fix security vulnerabilities in complex codebases. Built on a new architecture called Agentic MapReduce, it aims to deliver deep vulnerability detection beyond static analysis at lower cost.
July 1, 2026 · Cognition
Devin Security Swarm: AI That Finds, Verifies & Fixes Vulnerabilities
A swarm of agents scans an entire codebase, proves each exploit in an isolated sandbox, then writes patches and opens remediation pull requests — built on a new parallel architecture called Agentic MapReduce.
72%
recall — 36 of 50 real vulnerabilities detected
~30%
lower cost per finding vs the runner-up
14
languages covered — Go, Python, JS, Rust & more
Benchmark: 50 real GHSA vulnerabilities
Vulnerabilities detected (out of 50) — taller column is better
36
Devin Security
$90.23 / finding
34
Claude
$131.87 / finding
3 critical issues — including a PHP sandbox bypass via template injection — were caught by Devin alone.
Agentic MapReduce · 5 stages
Parallel agents, from threat model to pull request
1 · PLAN
Build threat model & selectors
→
2 · SHARD
Split signals into bounded batches
→
3 · MAP
Parallel child agents investigate each shard
→
4 · REDUCE
Dedupe, chain exploits, prioritize
→
5 · VERIFY
Reproduce in isolated sandbox (optional)
Full scan sets a baseline; later runs scan only the diff to keep costs low — scheduled daily or weekly.
Why it stands out
Reasons about business-logic flaws & chained, multi-file exploits
Reads the whole codebase like a security engineer, not by volume
Automates the full chain: detect → verify → patch → PR
The limits
Doesn't auto-fix everything — users choose findings to assign
Human review advised when runtime validation is inconclusive
Broad real-world assessment still limited so soon after launch
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…