Devin
Cognition's autonomous software engineer - give it a task, it plans, writes, runs, and fixes its own code. The agent that put 'agentic coding' on the map.
Delv Safety Grade: C
Score 58/100 · assessed 2026-04-18
Devin is a well-funded commercial product from Cognition, a legitimate venture-backed startup that pioneered autonomous coding agents. The maintainer score is solid given the company's profile and active development. However, the permissions footprint is enormous: full shell execution, filesystem writes, network access, repository writes, and browser control with no apparent sandboxing. The closed-source nature and lack of public repository mean zero code auditability. Supply chain is proprietary SaaS, which sidesteps traditional package risks but introduces vendor lock-in and opacity. No known security incidents, but the breadth of access required (terminal, browser, codebase, git) means a compromise or bug could be catastrophic. Suitable for teams willing to trust a commercial vendor with broad access, but the lack of transparency and massive permissions warrant caution.
Green flags
- Legitimate VC-backed company (Cognition) with known team
- Active development and enterprise customer base
- No known security incidents or breaches to date
- Professional support and SLA options for enterprise
Red flags
- Closed source with no public code audit possible
- Requires full shell execution and filesystem write access
- Browser and desktop control with unclear sandboxing boundaries
- No public incident response or security disclosure process visible
- Proprietary SaaS means vendor has full access to your codebase
Permissions requested
Pricing
Platforms
Review
Worth it for teams with a backlog of well-scoped grunt work. Solo developers should trial it on a meaty refactor before committing. Skip if your codebase lacks tests or you need creative problem-solving over execution speed.
Good at
- Genuine autonomy - debugs and iterates without supervision
- Handles multi-file changes and migrations better than chat-based tools
- Slack integration lets you queue tasks asynchronously
- Enterprise tier supports custom style guides and audit trails
- Saves hours on tedious, well-defined work
Watch out
- Can chase wrong solutions if codebase patterns are ambiguous
- Requires solid test coverage or ships broken code confidently
- Individual plan caps daily usage, burns through quota on heavy tasks
- Slower than Cursor for tasks where you already know the fix
- Sometimes ignores project conventions in favour of textbook patterns
Use cases
- Fixing bugs end-to-end from a ticket
- Adding a feature across a codebase unsupervised
- Batch code migrations
- Long-running refactors while you sleep