Cognition Adds Automated Code Scans to Devin, Its AI Software Engineer

Cognition has added a feature called Code Scans to Devin, its AI software engineer, that lets the agent sweep through a codebase and flag bugs, security problems and quality issues on its own, without a developer asking it to look. The company announced the capability on its blog. The move extends Devin from a tool that answers one-off prompts into one that patrols a repository continuously in the background.

The distinction matters because most review tooling today depends on a person deciding where to point it. Code Scans inverts that: the agent chooses what to inspect and returns findings. It is the same direction other agent vendors have taken over the past year, selling autonomous background labor rather than a chat window that waits for instructions.

Cognition's announcement left several practical questions unanswered. The company has not published detection benchmarks, pricing, or a list of supported programming languages, so what Code Scans actually catches, and how accurately, is not clear from the post alone. Those gaps matter for buyers trying to judge whether the feature replaces any existing static analysis or security scanning spend.

The launch lands in a crowded stretch for Devin. Cognition has spent much of the past year pitching the agent at enterprise engineering teams, where it competes with GitHub's Copilot coding agent, Cursor and a crop of startups selling autonomous bug-fixing and code review. Automated scanning gives an agent a reason to run with no human in the loop, which also opens the door to recurring subscription revenue rather than per-seat assistant pricing.

Independent code review is where coding agents have drawn the heaviest skepticism. Developers have complained repeatedly that agent-generated pull requests add review work instead of removing it, and that the tools flag formatting noise while missing genuine defects. Whether Code Scans sidesteps that problem comes down to precision and to how cleanly it plugs into existing CI pipelines, neither of which the announcement spells out.

Watch for Cognition to publish false-positive rates, language coverage, and whether scans can run on a schedule or fire on commits from outside the Devin interface. Those details will decide whether Code Scans is a genuine reduction in review load or one more queue of low-value findings for engineers to triage.