Subscribe
AI Coding
5 min read
axc
axc

Cognition Is Acquiring Corridor for Devin Security

Cognition says it is acquiring Corridor, which checks code as AI agents write it, to build out Devin Security. Neither side has disclosed deal terms.

Olivetti-style poster reading Cognition acquiring Corridor, with red, mustard and teal blocks labeled Prevention, Enforcement and Devin Security on cream paper.
Olivetti-style poster reading Cognition acquiring Corridor, with red, mustard and teal blocks labeled Prevention, Enforcement and Devin Security on cream paper.

Cognition, the company behind the Devin coding agent, said on October 29 that it is acquiring Corridor, a startup that builds security checks for code written by AI agents. "Today, Cognition is acquiring @corridor," the company posted on X. Corridor's co-founders, Jack Cable and Ashwin Ramaswami, describe the same deal in a post on Cognition's blog dated 2026.10.28, in their own words: "Today, Corridor is joining Cognition, where we'll be taking Devin Security to the next level."

Neither post gives a price or deal terms.

Cognition also released a new low-cost coding model for Devin on November 4, covered in our post on SWE-2 Flash.

What Corridor does

Corridor's homepage says the product "secures AI coding agents as they write code, enforces what's safe to ship, and scales with your team as agents take on more." The page splits the product into four parts:

  • Prevention. Corridor integrates with a coding agent, local or remote. It returns security guardrails based on the agent's plan, and for cloud agents it runs pre-commit scans so the agent can fix flagged issues itself. The page lists Cursor, Claude Code, Codex, Copilot, VS Code, Devin "and their cloud agents."
  • Enforcement. Corridor reviews every pull request. A team sets which severities must be clean, and Corridor enforces that as a required check and records every exception.
  • Observability. A dashboard shows which AI tools developers use, how much code their agents wrote, and whether it met the policy.
  • Triage and remediation. The Corridor Agent works through an existing vulnerability backlog with AppSec engineers.
Diagram of Corridor's four product parts, as listed on its homepage, next to the Devin Security upgrade

The homepage carries quotes from security leads at LangChain, WitnessAI, Sublime Security, Pylon, Casca and AppOmni. These are customer quotes chosen by the vendor, not independent test results.

Corridor has worked inside other agent tools before. Its Series A announcement points to partnerships with Cursor and Factory, "where Corridor runs natively inside the agents developers use." Factory's agent harness is covered in our post on Factory Droid 1.0.

Where it lands: Devin Security

The Devin Security upgrade came three days before Cognition's X post about the deal. In an October 26 post, Cognition called Devin Security "our product for finding, prioritizing, and remediating vulnerabilities end to end." Cognition says the upgrade adds:

  • Deep scans powered by "Claude Mythos and other frontier cyber models." Enterprise security teams can use them through Devin "without needing separate access to the models."
  • A living threat model that Devin builds with a customer's teams. It maps systems, services and hosts and the network policies that protect them. Devin uses it to re-score findings by exploitability and potential damage.
  • Four ways to respond to a finding. Devin can relabel a finding with evidence, apply a mitigation in infrastructure (for example a WAF rule or a security group change) "with configured access", fix the flaw in its own virtual machine and open a pull request, or help refactor out a recurring vulnerability class. Cognition says the infrastructure mitigations reduce exposure while a permanent fix is prepared and "the underlying flaw stays open." Each relabel proposal "requires human approval," and Cognition says KEV-listed vulnerabilities "are never relabeled."

Cognition also said it is "committing hundreds of millions of dollars in Devin credits," made up of free scans with frontier cyber models for current and future enterprise customers and remediation credits for new customers. The post lists no price for Devin Security and asks readers to contact its team.

By Corridor's description, its product works while an agent writes code and on every pull request, and its agent also works through an existing vulnerability backlog. By Cognition's description, Devin Security finds, prioritizes and remediates vulnerabilities end to end, including findings it ingests from other scanners. The two announcement posts do not say how the products will be combined, whether Corridor stays on sale on its own, or what changes for current Corridor customers.

The people

The founders' post names Cognition leaders they know. Russell Kaplan, Cognition's President, is "one of our earliest advisors," they write. Kaplan is also on the list of angel investors in Corridor's August 2025 seed announcement. That same post announced a $5.4M seed round led by Conviction and said Alex Stamos was joining Corridor full-time. Stamos is now Cognition's CSO, and the founders say they will "work together with Alex Stamos, Cognition CSO, once again."

Timeline of Corridor's funding and the Cognition deal, from Corridor and Cognition posts

The money so far

Corridor raised a $25M Series A at a $200M valuation in March 2026, led by Felicis, according to the company. The release lists Conviction, Timeless, Artisanal Ventures, Lux Capital, Sunflower Capital, Datadog and SV Angel as participants, plus angels from Anthropic, OpenAI, Cursor, Cognition, Factory and Lovable. That $200M figure is the valuation from the March round, not the price of this deal.

What the founders say

The founders frame the deal around attacks by AI agents. "The next 6-12 months represent the most consequential period in the history of cybersecurity," Ramaswami wrote in his X post, followed by: "AI agents can now execute end-to-end attack chains, and defenders need new tools to keep up." The same lines appear in the blog post.

Those are the founders' views. Earlier llms.blog posts covered embedded browser flaws in Codex, VS Code and Cursor and a Claude Code agent run by an Accenture contractor that, WIRED reported citing sources, appears to have sent DOD login credentials to a high-risk third-party site. Accenture told WIRED the allegations were "found to be without merit."

What is still unknown (as of November 4, 2026)

  • The price, and whether the deal is paid in cash, stock or both. We found no published price in the sources checked on November 4, 2026.
  • When the deal closes. Cognition's X post says it "is acquiring" Corridor.
  • What happens to Corridor's product, its integrations with other coding agents, and its pricing.

Sources

AI CodingSecurityAcquisitionsNews

Written by

axc
axc

Edited by the llms.blog desk.

More in Acquisitions

All Acquisitions →

Popular this week