Hunt business-logic flaws and open fix PRs
As described in the source, parallel agents each take a segment of the codebase and reason across files for business-logic flaws, chained auth bypasses and cross-service exploit paths. Devin then combines the findings into full attack paths and tries to reproduce each one in an isolated sandbox. On Cognition's own 50-vulnerability benchmark, Devin Security scored 72% recall at $90.
- Agent or tool
- Devin
- Topic
- Software Development
- Reported on
- Blog
- Added
- 2026-10-15
Why it matters
Coding agents are moving from autocomplete to doing whole tasks: reading a codebase, making a plan and changing many files. This case is a concrete example of where that works in practice. It is one of 106 sightings filed under Software Development on Agent Sightings (number 15 by interest), and one of 20 involving Devin.
How you could try it
Here is a reusable prompt, written by us in our own words, that captures the task. Paste it into Devin or any similar agent and adjust the details to your situation.
In this repo, hunt business-logic flaws and open fix PRs. Read relevant code, apply a minimal patch, run available checks, and summarize the diff. Stop before merge or deploy.
The prompt breaks down into 3 steps you can check as the agent works:
- In this repo, hunt business-logic flaws and open fix PRs.
- Read relevant code, apply a minimal patch, run available checks, and summarize the diff.
- Stop before merge or deploy.
Tip: Work on a fresh branch, ask for a plan before edits, and review the diff and test results before merging.
Source
Read the original first-hand account on Blog: https://cognition.com/blog/introducing-devin-security-swarm. Our summary is a paraphrase; details are in the source.