Mythos 5.2 more than doubles Opus 5.5 on Devin’s security test

Cognition, the company behind Devin and Windsurf, has made Claude Mythos 5.2 available in Devin Security for eligible enterprise customers. On its internal cyber benchmark the model scored 73.5, against 32.7 for Claude Opus 5.5.

Managed scans, with no direct model access

Access is limited. Cognition says Mythos 5.2 is open to eligible enterprise customers, and everyone else has to apply. Devin runs the scans itself with frontier cyber models, so a customer’s security team does not need its own access to them. That matters because Anthropic restricted the model at launch: our earlier report on the Fable 5.2 and Mythos 5.2 launch described Mythos as limited to verified organizations.

Cognition also says it is putting hundreds of millions of dollars in Devin credits behind the offer, with free scans using frontier cyber models for current and future enterprise customers. Eligibility criteria and conditions apply, and the announcement does not spell them out. It also does not say how many customers the credits cover or how long the program runs.

73.5 against 32.7 on 1,781 known bugs

Cognition ran the model on a benchmark of 25 open repositories. They cover C, Python, Go, PHP and TypeScript, with codebases built on Django, Flask, Laravel and Next.js. Each repository is pinned to a commit where publicly reported vulnerabilities remain, 1,781 in total.

The test extends Cognition’s earlier security benchmark, which only checked whether Devin Security found one target bug. With many known bugs per repository, the company can now also measure precision, meaning how many reported findings are real. It combines that with recall in an F2 score on a 0-100 scale that weights recall more heavily. Each model ran three times per repository, and Cognition reports the average.

Mythos 5.2 reached 73.5, up from 56.9 for Mythos 5.1, a gain of 16.6 points. Opus 5.5 managed 32.7, so Mythos 5.2 is more than twice as high, according to Cognition.

A vendor’s own test, and a recall-heavy score

The first caveat is who built the yardstick. This is Cognition’s internal benchmark, run by the company that sells the product, and the announcement does not point to an independent replication or a public dataset. The repositories are named by language and framework only.

The scoring choice also shapes the result. F2 rewards finding known bugs over avoiding false alarms, so a high score does not by itself say how many reports a security engineer would have to discard. The announcement gives no separate precision or recall figures.

Cognition’s separate FrontierCode results put Claude Fable 5.2 on top at 49.1%, and the same test gave Gemini 4 Carbon 40.0%. Those cover general coding, not vulnerability discovery, so they cannot be compared with the security scores. Mythos is also reaching customers through other restricted channels: Mythos 5.2 reached AWS GovCloud for allow-listed organizations only. Together these suggest the strongest cyber-capable models are being routed through managed, vetted services rather than open APIs.

What a security team can do with it today

For a company that is already an enterprise Devin customer, the practical step is to apply for access and the credits. Smaller teams and individual developers are not covered by the announcement. The page does not state pricing after the free scans, the regions covered, or the length of the credit program. Until the eligibility terms and independent testing appear, the 73.5 figure is best read as the vendor’s claim about its own test.