Cognition Acquires Corridor to Add Security Controls to Devin

Cognition, the company behind the Devin autonomous coding agent, is acquiring Corridor, a startup that secures code written by AI agents. Financial terms were not disclosed. Corridor’s team and product will join Devin Security.

Corridor integrates with Cursor, Claude Code, and Codex to provide security guidance during development, scan changes before commit, and review pull requests. Its software can enforce merge policies based on vulnerability severity, investigate findings through Slack or the web, and open pull requests containing proposed fixes.

Familiar team, existing ties

Corridor co-founders Jack Cable and Ashwin Ramaswami previously worked at the U.S. Cybersecurity and Infrastructure Security Agency. They started the company to address a growing review burden as AI agents produce more code and operate with greater independence. Cable has ranked among HackerOne’s top 100 security researchers and led CISA’s Secure by Design initiative.

Alex Stamos, the former chief security officer at Facebook and SentinelOne, invested in Corridor’s seed round and later joined the company full time ahead of its Series A. He had also conducted research with Cable and Ramaswami.

Stamos joined Cognition as chief security officer roughly a month before the acquisition. He told Axios that his role covered defending Cognition and developing security products. Cognition president Russell Kaplan was also listed among Corridor’s earliest advisers, indicating that the companies had established ties before the deal.

The price remains private

Faster output raises the review burden

AI coding agents can modify many files and repositories quickly, increasing the volume of code that developers and security teams must review. Agent-written code can contain familiar flaws such as unsafe input handling, exposed credentials, authorization errors, and vulnerable dependencies.

Static application security testing, commonly called SAST, inspects source code for vulnerabilities without executing it. These scans often run during continuous integration or pull-request review. Corridor adds feedback earlier in development, then carries repository-specific rules and severity policies through the merge process.

Adding those controls helps Cognition address a central enterprise requirement: teams need audit trails, enforceable policies, and remediation workflows before they allow agents to make production-bound changes. Devin’s disclosed customers include Mercedes-Benz, the U.S. Army, and AT&T, all organizations with substantial software governance requirements.

Inside Corridor’s controls

Corridor inserts security checks into the repeated cycle of planning, editing, testing, and revising code, often called the agent loop. Its product includes:

• Development guidance: Integrations with Cursor, Claude Code, and Codex provide feedback while developers and agents create code.
• Pre-commit scanning: Changes can be checked before they enter a pull request.
• Repository-specific policies: Security teams can write requirements in plain English, which Corridor translates into checks tailored to a codebase.
• Merge enforcement: Pull requests can be approved or blocked according to vulnerability severity.
• Automated investigation: An agent can triage findings through Slack or the web and open pull requests with proposed fixes.
• Operational visibility: A dashboard tracks AI tool usage, agent activity, and compliance with security policies.

Questions for current customers

Cognition has not published an integration schedule for bringing Corridor’s controls into Devin. The acquisition suggests tighter links between code generation, security review, policy enforcement, and remediation, but product packaging and release timing remain unspecified.

• Third-party integrations: Cognition has not said whether Cursor, Claude Code, and Codex will retain the same level of support.
• Commercial terms: Pricing, contract migration, and support arrangements for Corridor customers remain undisclosed.
• Deployment and data: Cognition has not detailed future hosting options, data boundaries, retention policies, or access controls.
• Detection quality: Public benchmarks for vulnerability coverage, false positives, false negatives, and automated fixes have not been released.

Stamos has also said Cognition is considering products that automate secure software development, including systems that rewrite older enterprise applications for modern containerized environments. Such products would extend Devin Security beyond pull-request scanning, though Cognition has not tied that work to a release date.

Security becomes part of the agent stack

AI coding vendors are increasingly packaging code generation with review, policy enforcement, and remediation. Enterprise evaluations will test detection quality, auditability, deployment controls, interoperability, and the reliability of automated fixes. Corridor gives Cognition an established product and security team; the remaining test is how well those capabilities integrate with Devin while continuing to support customers using competing coding agents.