Cognition announced a 30‑day checklist aimed at securing developer tooling and coding agents after a spate of high‑profile security incidents.
Jack Cable, Cognition’s Head of Security Products, said the guide was prompted by recent events he described as “the largest theft in recorded history” and a series of vulnerabilities affecting PHP, GitLab, edge devices, a certificate authority, and a malicious version of the Claude Code Cursor extension. The guide lists immediate actions for corporate accounts, development environments, codebases, dependencies, and monitoring.
For corporate accounts, Cable recommends phishing‑resistant multi‑factor authentication and device‑bound sign‑in for high‑risk services, an audit of the public‑facing attack surface using a coding agent, deployment of a password manager, and installation of a reputable ad blocker. In development environments, he advises scanning machines for secrets with tools such as TruffleHog, auditing installed extensions and plugins, and enforcing a minimum package age of seven days for npm and PyPI packages.
Code security steps include running a frontier model on codebases and critical open‑source dependencies, scanning source, images, and build artifacts for secrets, and pinning versions in lockfiles. Monitoring recommendations focus on immutable logs for identity providers, cloud audit, source‑control/CI, and production data, with alerts for new admin accounts, MFA changes, new devices, large data exports, and unusual secret reads.
Within 30 days, the checklist calls for mobile‑device‑management and endpoint‑detection‑and‑response on every corporate device, allow‑listing Chrome and VS Code extensions with delayed auto‑updates, and a full corporate attack‑surface audit that assumes a compromised engineer device.
Sources
Fan coverage from Devin Central — not an official Cognition announcement. Devin is a trademark of Cognition.