Corridor

Corridor is joining Cognition to build the future of Devin Security. We’re grateful for the support of our customers, investors, and partners along the way, and we can’t wait to show you what we build next.

AI can save time writing code, but it has the tendency to create more work for the person reviewing it. At Corridor, we built a skill to help agents write clearer PR descriptions and check them against the code. We’ve shared what worked and the skill itself: corridor.dev/research/pr-des…

While we were in New York, we hosted a happy hour for security and engineering practitioners to get together and talk about what it takes to secure AI-driven development. Our CEO @jackhcable shared our recent research on coding agents. A routine support ticket was enough to get agents to run malware and leak secrets. As agents take on more of the work, their own judgment can't be the only guardrail. We also heard from @JamesBerthoty (@latiotech), @Guy_Flechter (@SolaSecurity) and @kylebhiro (@runpensar), on topics ranging from securing coding agents to the limits of LLMs on defense. A common thread: agents have changed both how code gets written and how it gets attacked, and security has to move closer to where the code is being written. Our takeaway: the goal isn't to slow agents down. It's to give teams the confidence to let them do more. Thank you to @SolaSecurity for sponsoring, to our speakers, and to everyone who came out.

Last week in New York, we brought together a small group of security, AI and engineering leaders from companies including @clay, @figma, @crosbylegal, and Numerix, along with analysts from Latio, for dinner and a candid conversation about the problem everyone is feeling right now: AI is writing code faster than ever, and security hasn't kept up. A lot of the industry is focused on using AI to find and patch vulnerabilities. Around the table, the view was that this misses the point. Securing existing codebases matters, but if the code agents are writing today isn't secure, teams are creating problems faster than they can fix them. Our takeaway: autonomous development, done well, should make software stronger, not riskier. Thanks to everyone who joined us.

We recently demonstrated that TypeSafe’s Jev could be used to gate when our security scan should be run. Since then, OpenAI, Microsoft, Perplexity, and a dozen others shipped decision models of their own. So we ran all of them through the same benchmark for this task. The top two models are Perplexity's Decider and TypeSafe's Jev 1.14. At any budget for latency, cost, or precision, Decider or Jev catches the most vulnerable posts. The rest are at or below the performance of an LLM gate. Full results and the dataset in our latest post: corridor.dev/blog/decision-m…

This time next week, Corridor will be in NYC! 🏙️ ​Join us for happy hour on Thursday, October 15th and hear from @JamesBerthoty and @Guy_Flechter about approaches to securing agentic coding plus @jackhcable's recent research on AI Agents targeting government websites. Come for free food and drinks but stay to exchange best practices in this new age of appsec 🍕🍻 Register today: luma.com/corridor-wkbl

Coding agents now open PRs and push commits in long-running sessions where humans barely look. Our security enforcement for long-running agents scans every change before the agent commits, but a full scan on every commit is slow and expensive, and many commits are obviously safe. So we put a gate in front of each scan to decide which commits need the full check. We tested five gates: Jev (a decision model), CLM-8B, and three LLMs prompted for a confidence score. Jev halved our scanning costs and raised precision with minimal loss in recall. LLM gates helped, but less. CLM-8B off the shelf did not work as a gate. We wrote up what we learned in our latest blogpost: corridor.dev/blog/decision-m…