What happened
Cognition’s November 11, 2026 announcement says Claude Mythos 5.2 is available in Devin Security for eligible enterprise customers. Organizations that do not yet have access can apply. Devin describes the product as managed scanning with frontier cyber models, designed so a security team can use the models without separately obtaining access to them.
The announcement pairs that access change with a large credit commitment. Cognition says it is giving more than $100 million in Devin credits to enterprises to help them find and fix their most critical vulnerabilities with Claude Mythos 5.2. It also says current and future enterprise customers can receive free scans with frontier cyber models, including Mythos 5.2. The company repeatedly states that eligibility criteria and conditions apply. It does not present either the service access or the credit offer as automatically available to every company.
Cognition also publishes results from an internal vulnerability-discovery benchmark. Claude Mythos 5.2 received a mean score of 73.5. Claude Mythos 5.1 scored 56.9, while Claude Opus 5.5 scored 32.7. The announced benchmark covers 25 repositories across C, Python, Go, PHP and TypeScript. It includes codebases built with Django, Flask, Laravel and Next.js, so the test set spans more than one language and application framework.
Each repository is pinned to a commit at which publicly reported vulnerabilities are still present. Cognition says the 25 repositories contain 1,781 such vulnerabilities in total. This differs from the company’s original security benchmark, which measured whether Devin Security found one target bug. The newer setup lets Cognition assess many known issues in the same repository rather than treating discovery as a single pass-or-fail outcome.
The company says the score incorporates recall and precision. Recall is the share of known vulnerabilities found by the model; precision is the share of reported findings that are real. Its F2 score combines those measures on a 0–100 scale while weighting recall more heavily. Cognition says it ran every model three times on every repository and reports the mean score. That methodology makes the comparison more informative than a single run, but it remains Cognition’s evaluation of models in its own managed-scanning setup.
The announcement does not say that Mythos 5.2 is directly available as a general-purpose model endpoint, nor does it describe a self-service purchase flow. Its described delivery mechanism is Devin Security, and its named audience is eligible enterprise customers. The practical proposition is therefore managed vulnerability scanning plus subsidized credits, rather than a broadly disclosed model release for all developers.
What the archive adds
New Runtime’s earlier coverage examined Google’s OSS Vulnerability Reward Program narrowing the reports it accepts (October 6, 2026 note). That concerned rules for submitted vulnerability reports rather than managed scanning or enterprise credits. Cognition’s announcement is a new fact in the wider vulnerability-discovery and remediation space, not a continuation of Google’s policy change.
Trend signal
This weakly supports the pattern that agent economics moves to completed work. Cognition frames the offer around finding and fixing critical vulnerabilities, rather than token consumption or model-call volume. Still, the announcement gives neither a cost per confirmed finding nor a cost per verified remediation, so it does not yet show whether the economic unit has actually shifted to completed security work.
Why now
Cognition explicitly presents the offer as a response to a “new threat landscape” and launches it alongside the availability of Mythos 5.2 in Devin Security. The announcement does not name a particular external incident, newly disclosed vulnerability, regulation, or customer demand that triggered the timing. Its stated rationale is broad preparation for a changing security environment.
Why it matters
For a security team, this changes the initial cost and access equation for evaluating model-assisted vulnerability discovery. A team may be able to test a managed service without first arranging separate access to the underlying cyber model, while credits can reduce the budget required for a pilot. That is useful when the organization wants evidence from its own repositories before committing to a new scanning workflow.
The benchmark’s inclusion of precision is operationally important. Finding more vulnerabilities is not sufficient if a system also creates a queue of invalid findings that engineers must investigate. Review capacity is limited, and false positives can delay remediation of genuine issues. Cognition’s F2 measure favors recall, which may suit a discovery workflow, but teams should decide whether that balance matches their own triage capacity and risk tolerance.
The responsible evaluation unit is not the published model score. It is the number of findings a team confirms, prioritizes and fixes, plus the review time required to reach those outcomes. Organizations considering the offer should confirm eligibility, define the permitted scan scope, test against representative repositories, and compare confirmed results with their existing security process.
Limits and uncertainty
The benchmark is internal to Cognition. The announcement does not provide an independent replication, customer deployment results, or a third-party comparison under the same conditions. It gives the number of repositories, the total vulnerability count, the repeated-run method and a high-level scoring definition, but not per-repository scores, separate precision and recall values, or individual finding-level data.
The company also does not disclose the eligibility rules, credits available to each customer, duration of the credits, scan cadence, repository limits, supported deployment environments, or the terms governing remediation work. The repositories are pinned to historical commits with publicly reported issues; that can be a useful controlled test set, but it is not the same as a live production environment with an organization’s current code, policies and threat model. The ranking should therefore not be treated as a guarantee of performance elsewhere.
Skill to build now
Create a small evaluation protocol before using any agentic security scanner. Select one or two representative repositories, define what counts as a confirmed finding, record reviewer time and false positives, and track whether confirmed issues reach an accepted fix. Run the pilot within an approved scope and compare those measures with the team’s existing scanning process. This turns an access or credit offer into a decision based on verified remediation work rather than a benchmark headline.
Reader takeaway
Cognition is offering eligible enterprises a managed route to test Mythos 5.2 vulnerability scanning through Devin Security, backed by more than $100 million in credits. The company’s 73.5 benchmark score is a useful signal about its own test setup, not proof of results in your environment. Validate findings, review burden and completed fixes on your own repositories.
Open question
What eligibility rules, credit allocation, scan scope and remediation terms will Cognition apply to the more than $100 million offer?