Cognition Open-Sources Devin Vulnerability Fix Plugin; New Research on AI Coding Agent Efficiency and Cost

Cognition Open-Sources Devin Vulnerability Fix Plugin; New Research on AI Coding Agent Efficiency and Cost

This week, Cognition open-sourced the Devin Vulnerability Fixes plugin, which includes three MIT-licensed agent skills that automatically scan for and fix remote code execution vulnerabilities in PHP, Node.js, and GitLab. At the same time, a controlled study poured cold water on the hype around coding agent tools: more complex tools don't necessarily yield higher success rates, but costs can triple.

Devin Vulnerability Fix Plugin: Three Agent Skills Cover Three Major Tech Stacks

According to Cognition's official announcement, the plugin is offered as three separate agent skills, targeting PHP, Node.js, and GitLab deployment environments respectively. The workflow is clear: first scan the affected codebase to identify critical vulnerabilities with remote code execution (RCE) risk, then automatically apply patches and run tests, and finally open a pull request for each repository.

This design transforms security remediation from manual investigation into an agent-driven automated process, particularly suited for teams maintaining large numbers of legacy projects. The MIT license means enterprises can freely integrate it into their internal CI/CD pipelines.

Coding Agent Research: Tool Complexity Decoupled from Success Rate, but Costs Soar

A controlled study compared coding agent tools such as Claude Code, OpenCode, and Mini SWE Agent, with intriguing conclusions: switching between different tools improves task success rates by roughly the same amount as simply re-running the same test. In other words, the gains from switching tools may just be random fluctuation.

More critically, there's the cost. The study points out that per-task costs can increase up to threefold, mainly because the system prompt accumulates with each step sent. This suggests teams should not only look at benchmark scores when selecting tools, but also account for actual token consumption and marginal returns.

System prompt accumulation cost: In the call chains of most coding agents, each round of tool invocation re-sends the complete system prompt, conversation history, and tool return results to the model. "Accumulation" here means the system prompt is not sent just once, but is linearly repeated in the token bill with each conversation step. Agents often need dozens or even hundreds of steps to complete a task, so even if a single prompt is only a few thousand tokens, total consumption quickly balloons. This is also why more complex tools with longer built-in instructions are more likely to double per-task costs. When evaluating agents, teams should incorporate "average steps × per-step context length" into their cost model, rather than merely comparing per-call prices.

Microsoft Agent Grid: 1,024 Agents Without a Central Coordinator

Microsoft Research has released Agent Grid, a framework supporting self-organizing collaboration among up to 1,024 agents. These agents share a Git repository, chat room, and discovery board, with no central scheduler. In a 6-hour budget test on Program Bench, the system demonstrated scaling from a single agent to 1,024 agents, proving that coordination can rely on shared artifacts rather than centralized orchestration.

This approach offers inspiration for building large-scale multi-agent systems: reduce single points of bottleneck and use the environment itself as a coordination medium.

Security and Isolation: Entropic Sandbox Runtime and OpenAI's Vulnerability Discovery

Entropic has open-sourced the Sandbox Runtime (SRT), providing containerless isolation for agents such as Claude Code. It restricts file and network access for agents, MCP servers, and command-line tools, implemented via Seatbelt on macOS and Bubblewrap on Linux, running without containers.

On the vulnerability discovery side, OpenAI's Project Daybreak provides the most powerful hacking models to vetted partners for finding and fixing vulnerabilities. According to Forbes, the project helped discover a critical remotely exploitable vulnerability in PHP 2.0, showing that AI is accelerating both offense and defense.

Meanwhile, three former OpenAI security researchers—Tomek Korbak, Mikita Balesni, and Jasmine Wang—denied leaking confidential information, stating that the company never specified in writing what the alleged leak consisted of. The matter relates to their advocacy for monitorable AI systems, and details remain disputed.

Isolation mechanisms of Seatbelt and Bubblewrap: Seatbelt is macOS's built-in sandbox policy framework, which restricts the file paths, network ports, and system calls accessible to a process through declarative configuration files; Bubblewrap is an unprivileged sandboxing tool on Linux that uses user namespaces and mount namespaces to construct a minimal visible filesystem view for a process. Neither requires a Docker daemon or a full container image, so startup overhead is low, making them suitable for constraining agent behavior directly on a developer's machine. SRT leverages these two operating system primitives to narrow the file and network permissions of agents, MCP servers, and command-line tools to explicit allowlists, achieving isolation without introducing container complexity.

Python 3.15 Sampling Profiler: Attach to Running Processes and See Who Holds the GIL

Python 3.15 introduces the sampling profiler Tachyon, which via the profiling.sampling module can launch a program or attach to an already running process without restarting or importing libraries. It can view all threads, distinguish CPU work from waiting, and identify who holds the GIL—something cProfile cannot do. However, results are statistical estimates, not precise call counts.

For performance tuning, this fills a key gap in non-intrusive production profiling.

GIL and sampling profiling: The GIL (Global Interpreter Lock) is a mutex in CPython that ensures only one thread executes Python bytecode at a time; it makes multithreading difficult to parallelize on CPU-intensive tasks and makes "who holds the GIL" a key clue for diagnosing performance bottlenecks. A sampling profiler interrupts the program at a fixed frequency (e.g., every millisecond), records the current call stack, then tallies the frequency of each function to estimate the time distribution—resulting in minimal intrusion and the ability to attach to production processes. In contrast, cProfile inserts hooks at every function call site for precise counting, which is expensive and cannot attach to already running processes. Tachyon's value lies in trading statistical estimation for low overhead and runtime visibility, at the cost of sampling error in results.

Privacy Boundaries of ChatGPT Locked Conversations

ChatGPT has added Locked Chats, allowing users to lock conversations with a four-digit PIN or mobile biometric authentication, after which they disappear from history and search. However, already-created share links remain valid, and content the model remembered before locking remains in regular memory and must be manually deleted. Privacy features have boundaries, and users need to understand their limitations.

Replit Shifts to OpenAI: Infrastructure Shakeup Under Price Pressure

According to The Information, Replit is shifting most of its AI spending from Entropic to OpenAI. OpenAI offered over 30% discounts in agreements exceeding $100 million annually, after Entropic had canceled its discounts. This reflects that OpenAI's price pressure strategy is starting to pay off, and it has also intensified nervousness in the AI infrastructure market: neocloud stocks such as CoreWeave and Nebius have fallen more than 30% since early October, and CoreWeave's credit default swap premium exceeds 11%.

Other Developments: Model Bias, AI Ad Labeling, and Courses

A study by Convovo presented nearly 500 forced-choice election matchups to Grok 4.7 and GPT 6.1 Sol via API; Grok chose Republicans in 92% of responses, GPT chose Democrats in 97%, and their agreement rate was under 10%. OpenAI responded that API behavior does not represent the ChatGPT app experience.

Pennsylvania Governor Josh Shapiro signed a law requiring ads generated or significantly modified by AI (images, video, audio, text) to be labeled in the same format, regardless of where they were produced. The law exempts satire, parody, and obvious fiction, but the definition of "significantly modified" is vague.

Additionally, Sebastian Raschka released a video course on building a reasoning model from scratch, featuring over 11 hours of Python and PyTorch coding, covering evaluation, inference-time scaling, reinforcement learning, and distillation.

One-line Summary

Cognition open-sources the Devin vulnerability fix plugin; research shows limited gains from switching coding agent tools while costs can triple.

Paragraph Summary

Cognition open-sourced the Devin Vulnerability Fixes plugin, using three MIT-licensed agent skills to automatically scan for and fix remote code execution vulnerabilities in PHP, Node.js, and GitLab, covering the workflow from scanning and patching to running tests and opening PRs. Meanwhile, a controlled study cooled enthusiasm for coding agent tools: switching tools improves success rates by about as much as re-running the same test, but per-task costs can increase up to threefold, mainly because system prompts accumulate with each step. Other developments include Microsoft Research's Agent Grid supporting self-organizing collaboration among 1,024 agents without a central coordinator, Entropic's open-source containerless isolation Sandbox Runtime, OpenAI Project Daybreak helping discover a critical PHP 2.0 vulnerability, Python 3.15 introducing the attachable sampling profiler Tachyon, the privacy boundaries of ChatGPT locked conversations, Replit shifting to OpenAI under price pressure, and research on model election bias plus Pennsylvania's AI ad labeling law.