Understand this story
On October 23, 2026, Cognition announced the open-sourcing of an agent plugin designed to help systems defend against recent cybersecurity threats. According to information released by Cognition, the plugin can be installed on any agent and can also be used directly in Devin. Subsequent reports further stated that the open-source, free plugin is named Devin Vulnerability Fixes and includes three Agent skills—fix-php-vuln, fix-node-vuln, and fix-gitlab-vuln—under the MIT license, targeting PHP2Shell, the Node.js October security release, and the CVSS 10.0 self-managed GitLab vulnerability CVE-2026-110264, respectively; the skills execute in five steps: read-only inventory, approval, target version verification, before-and-after testing, and one PR per repository, and can run in agents that read SKILL.md, such as Devin, Claude Code, Codex, Cursor, and GitHub Copilot, requiring git, shell, Docker, and image registry access permissions, with npx installation requiring Node.js 22.20 or later. The report also stated that the original article did not publish a fix-rate benchmark, and that hosted runtimes, all-in-one machines, and Electron applications are only flagged rather than patched.
AI-generated from public reports
Developments
1 confirmed developments
Cognition open-sources an Agent plugin for cybersecurity threats
Source:Cognition
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 25
MarkTechPost
Cognition Open-Sources Devin Vulnerability Fixes Plugin, Covering Three High-Severity Vulnerability Categories in PHP, Node.js, and GitLab
Cognition has released the open-source, free Devin Vulnerability Fixes plugin, which includes three Agent skills—fix-php-vuln, fix-node-vuln, and fix-gitlab-vuln—under the MIT license, targeting PHP2Shell, the Node.js October security release, and the self-managed GitLab vulnerability CVE-2026-110264 with a CVSS score of 10.0. The skills execute in five steps: read-only inventory, approval, target version verification, before-and-after testing, and one PR per repository. They can run in agents that read SKILL.md, such as Devin, Claude Code, Codex, Cursor, and GitHub Copilot, and require git, shell, Docker, and image registry access; npx installation requires Node.js 22.20 or later. The original article does not publish a fix-rate benchmark; hosted runtimes, all-in-one machines, and Electron applications are only flagged and not patched.
Oct 23
CognitionFirst-party
Cognition Open-Sources Agent Security Plugin
Cognition announced the open-sourcing of an agent plugin designed to help systems defend against recent cybersecurity threats. The plugin can be installed on any agent and can also be used directly in Devin.