Cognition brings Claude Mythos to Devin Security with free scans

Felix Laurent 26 Oct 2026 4 min read

ai agents

Cognition launched a new version of Devin Security on October 26, 2026. Its deep scans now run on Claude Mythos and other frontier cyber models. Enterprise customers reach them through Devin, without their own access to the models. Cognition also committed "hundreds of millions of dollars" in Devin credits for free scans and fixes.

We read the announcement against Anthropic's own access terms for Mythos. The pledge has no published figure per customer. And Anthropic opened its own route to Mythos for cyber defenders three weeks earlier.

What Cognition announced

Cognition announced two initiatives in one post. The first is an upgrade to Devin Security, its AI vulnerability scanner and remediation product. The second is a credit program for current and future enterprise customers.

On X, the company opened with "We are entering a new dark age of cybersecurity." The blog post makes the case in plainer terms. AI makes complex attacks easier to carry out. Defenders get less time to respond. Security teams already hold more findings than they can fix.

Cognition says Devin Security is model-neutral. Deep scans use Claude Mythos "and other frontier cyber models." Cognition says it will pick the best models for the work as labs release new ones. The post does not name the other models or the Mythos version.

Devin also takes in findings from existing scanners, bug bounties and advisories. It removes duplicates and re-checks each finding with frontier models.

How Devin handles a finding

Every engagement starts with a threat model. Devin builds it with the customer's security and engineering teams. It maps services, hosts, network policies and security groups. It records which code is deployed and which is unused. It also adds business impact, such as what happens if one user reads another user's data.

Devin then re-scores each finding by exploitability and potential damage in that environment. Cognition lists four ways to resolve one:

Relabel with evidence. Devin documents a false positive or proposes a risk adjustment. Each proposal needs human approval. The original CVSS score stays next to the new one, and vulnerabilities on CISA's KEV list are never relabeled.
Mitigate in infrastructure. With configured access, Devin can add a WAF rule, change a security group or remove public access to a service. The flaw itself stays open.
Fix the flaw. Each Devin session runs in its own virtual machine. It reproduces the vulnerability, writes a fix, runs the tests and opens a pull request with the evidence. Cognition says it can run "thousands" of these sessions at once.
Refactor the class. For recurring flaws, Devin helps plan and implement a wider change, such as centralizing authorization checks.

Results sync back to existing security tools. Records export to POA&M and GRC systems – the paperwork that federal and regulated customers file for open findings.

What Cognition has published

The post gives the scope of the program but few numbers. The table lists what the post says and what it leaves out.

Claim	Figure
Models behind deep scans	Claude Mythos and "other frontier cyber models"; versions not named
Credit program, total	"Hundreds of millions of dollars" in Devin credits
Free scans	Current and future enterprise customers
Remediation credits	New customers
Credits per customer	Not published
Benchmark for deep scans	Not published
Price	Not published; "contact our team"

The only published benchmark comes from the previous version. Cognition launched Devin Security Swarm on July 1. It said the tool found 36 of 50 real vulnerabilities from GitHub Security Advisories in 14 languages. Cognition also claimed a 30% lower cost per finding than the next most accurate tool. That test predates Mythos in the product, and Cognition ran it on its own set.

Who else can reach Claude Mythos

The pitch rests on Mythos being hard to get. Anthropic launched Claude Mythos Preview on April 7 under Project Glasswing. It had 12 launch partners, including AWS, Apple, Google, Microsoft, CrowdStrike and Palo Alto Networks. Anthropic committed up to $100M in usage credits. It says it does not plan to make Mythos Preview generally available.

On June 9, Anthropic released Claude Mythos 5. Anthropic describes it as the same model as Claude Fable 5 with some safeguards lifted. It costs $10 per million input tokens and $50 per million output tokens. Access went to Glasswing partners and cyber defenders. It was suspended on June 12 and restored on July 1.

Two things changed since then. Anthropic's transparency hub says Claude Mythos 5.1 is "available only through our trusted access programs and Claude Security." Claude Security is Anthropic's own vulnerability scanner. And on October 6, Anthropic expanded its Cyber Verification Program to three access tiers, each with Mythos 5.1.

So Cognition sells Mythos-powered scans next to the model's maker. Anthropic offers the same model through its own security product. Security teams can also apply to its verification program directly. Cognition's post does not say which Anthropic program gives it Mythos access.

Where this fits for Cognition

Security is now a steady line for Cognition. Devin Security Swarm shipped on July 1, and a remediation program followed on July 2. On July 28, IT services firm LTM said it would deploy Devin across its cybersecurity practice of more than 260 clients. Devin has been listed as FedRAMP High in-process since July 13.

The credit pledge follows a large raise. On September 8, Cognition said it raised over $2B at a $48B valuation, led by Andreessen Horowitz and Accel. On September 25, it said it crossed $1B in annualized revenue run rate.

What is still missing

Cognition has not said how the credits are split or who qualifies beyond "enterprise." It has not named the Mythos version or published a benchmark for deep scans. Anthropic's price for Mythos 5 is public, while Cognition's price for Devin Security is not.