Cognition Acquires Corridor: Guardrails for Agent-Written Code Join Devin Security

Short answer: Cognition, the company behind the Devin coding agent, is acquiring Corridor, a startup that checks code written by AI agents. Per AlphaSignal's report published October 29, 2026, Corridor's team and product will join Devin Security, and financial terms were not disclosed. The deal arrives three days after Cognition launched Devin Security on October 26.

We could not open a standalone Cognition announcement for the deal, so treat the specifics below as reported, not as company-confirmed, until Cognition or Corridor publishes its own post.

TL;DR

What Corridor actually does

Corridor's homepage pitches itself as a way to keep a human-grade security check inside an agentic workflow: "Autonomous agents ship without a human in the loop. Corridor keeps security in it." It says it secures AI coding agents as they write code, enforces what is safe to ship, and scales as agents take on more. Customer quotes on the site come from security leads at LangChain, WitnessAI and Sublime, all complaining about the same thing: conventional scanners are noisy.

AlphaSignal's write-up lists the product pieces:

• Development guidance through integrations with Cursor, Claude Code and Codex, so the agent gets feedback in its loop.
• Pre-commit scanning, checking changes before they enter a pull request.
• Repository-specific policies written in plain English that Corridor translates into checks tailored to the codebase.
• Merge enforcement, approving or blocking pull requests by vulnerability severity.
• Investigation and fixes through Slack or the web, including pull requests that contain proposed fixes.

The key idea is placement. Traditional static application security testing runs in CI after a pull request exists. Corridor moves the check earlier, into the plan, edit, test, revise loop that agents repeat, and then carries the same rules through to the merge gate.

Why Cognition wants it

Cognition has been building out a security story quickly. Its October 26 post on X introduced the new Devin Security as "powered by Claude Mythos and frontier cyber models, plus hundreds of millions of dollars of credits to help teams find, prioritize, and fix urgent vulnerabilities," and described four steps: build a threat model with your team, deep scan, prioritize by exploitability in your environment, and reproduce, patch and test fixes in parallel. You can read the launch on Cognition's X account, and we covered the mechanics in our Devin Security explainer.

That product is about finding bugs that already exist. Corridor addresses the other half: stopping new ones from landing when an agent writes thousands of lines overnight. Together they make a coherent pitch for an enterprise security team: sweep the backlog, then police the stream.

AlphaSignal frames the commercial logic around audit trails, enforceable policies and remediation workflows, the things large organizations demand before they let an agent make production-bound changes. It lists Devin's disclosed customers as Mercedes-Benz, the U.S. Army and AT&T, all with heavy software governance requirements.

The people: ex-CISA founders and a familiar CSO

According to AlphaSignal:

• Jack Cable and Ashwin Ramaswami previously worked at CISA. Cable has ranked among HackerOne's top 100 security researchers and led CISA's Secure by Design initiative. Both are joining Cognition.
• Alex Stamos, formerly chief security officer at Facebook and SentinelOne, invested in Corridor's seed round and later joined the company full time before its Series A. He joined Cognition as chief security officer roughly a month before the acquisition, and told Axios his role covers defending Cognition and building security products.
• Cognition president Russell Kaplan was listed among Corridor's earliest advisers, so the two companies had ties before the deal.

Investors in Corridor's rounds, per the same report, include Felicis, Conviction, Timeless, Artisanal Ventures, Lux Capital, Sunflower Capital, Datadog, SV Angel and individuals affiliated with Anthropic, OpenAI, Cursor, Cognition, Factory and Lovable. Cognition's valuation is reported at roughly $48 billion.

Where this fits in Cognition's acquisition run

Cognition is no stranger to buying. It bought Windsurf in 2025 and, in July 2026, acquired Poke to give Devin a messaging interface. Corridor is a different kind of purchase: not a new surface, but a control layer. It also lines up with Cognition's more recent technical output, such as its FrontierCode 2.0 claims and its work on on-call triage agents, where autonomy is the product and trust is the constraint.

The competitive picture

Everyone shipping coding agents is converging on the same problem: the agent's output has to be checked by something other than the agent. Anthropic's own Claude Security offers continuous scanning and fix tracking. Open projects take the policy-as-code route, like Bernstein, or intercept tool calls locally, like Hugging Face SafeAgents.

What stands out about Cognition's move is vertical integration: one vendor that writes the code, scans it, and blocks the merge. That is convenient, and it is also a conflict of interest worth naming. The same company grades its own agent's work. Independent verification, by a scanner or a human reviewer that does not share the agent's incentives, remains a separate question buyers should ask.

What builders should do now

A green key fitting a narrow opening in a fence, illustrating scoped permissions for AI coding agent security

• If you use Corridor today, check your contract and its documentation for any change in data handling after the deal closes. Ask whether the Cursor, Claude Code and Codex integrations remain supported.
• If you use Devin, expect pre-PR guardrails to show up in Devin Security. Cognition has not published a schedule, so do not plan around a date.
• If you run agents from several vendors, a vendor-neutral policy layer is easier to keep than one tied to a single agent. Write your security rules in plain language and keep them portable.
• Whatever you choose, keep the principle of least privilege for the agent itself. A scanner is not a substitute for scoped credentials, as the reported Accenture contractor case on a DOD network illustrates. For stopping agents before they take dangerous actions, AgentBeam is the agent security platform from the explainx.ai team.

How to judge any security layer for agent-written code

Whether you buy from Cognition, another vendor, or build your own, a few questions separate a useful guardrail from a checkbox:

• Where does it run? A check inside the agent loop catches a flaw while the agent can still fix it cheaply. A check only at merge time forces a rewrite after the work is done. Corridor's pitch is that it does both.
• What does it block, and on what evidence? Severity-based merge policies are only as good as the severity labels. Ask for the false-positive rate on your own repositories, not a demo repo, because noisy tools get switched off.
• Can you write rules in your own words? Plain-English policies are convenient, but you should be able to read back exactly what check was generated from each one.
• Who sees your code? A pre-commit scanner reads unreleased source. Find out where it is processed, how long it is stored, and what changes if the vendor is acquired.
• Is the reviewer independent of the author? If the same vendor builds the agent and the guardrail, test the guardrail against code produced by other agents too.

Run a two-week pilot on a non-critical repository, count the real vulnerabilities caught against the noise, and only then widen the policy to production services.

Questions we cannot answer yet

1. Price and structure. Cognition did not disclose terms. Whether it was cash, stock or both is unknown.
2. Timeline. AlphaSignal calls the deal an acquisition in progress. We have not seen a closing date.
3. Product continuity. The existing integrations with Cursor, Claude Code and Codex are listed on Corridor's site and in third-party coverage; their future is not stated.
4. Evidence. Corridor's website quotes customers praising low noise, but we have not seen an independent benchmark of its detection rate against other scanners.

What this tells us about the market

Security has become the gating factor for agent adoption. The reported customers, an automaker, a defense branch and a telecom, are exactly the organizations that need audit trails before they allow autonomous changes. When a coding-agent company spends money on a security startup founded by former government cyber officials, the signal is that buyers are asking for controls before capability.

For readers learning to build with agents, the practical lesson is to design the guardrails and the generator together. Write policy in plain English, enforce it at the commit and merge boundaries, and log what the agent did. That pattern holds whichever vendor wins.

Related reading

• Devin Security: Claude Mythos deep scans and credits
• Cognition acquires Poke
• Cognition FrontierCode 2.0: claimed vs verified
• Devin on-call: AI SRE triage
• Claude Security: continuous scanning and fix tracking
• Bernstein: policy-as-code for coding agents
• Hugging Face SafeAgents

Sources: Corridor, AlphaSignal, Cognition on X.

Details are as reported on October 29, 2026 and may change when Cognition or Corridor publishes its own announcement.