Devin Review caught the axios supply chain attack before public disclosure (Cognition / Scott Wu)

TL;DR

Scott Wu (Cognition CEO) reports that Devin Review — Cognition’s AI code-review agent — flagged the axios npm supply-chain attack for multiple Cognition customers before public disclosure of the compromise (a trojanized release of the axios JS HTTP library on 2026-03-30/31 that introduced a multi-platform RAT and saw ~100M weekly downloads in its blast radius). One redacted screenshot of a Devin Review comment is shown, dated within an hour of the malicious release. Wu’s framing: as AI raises the cadence of supply-chain attacks, repo maintainers need AI on the defensive side too.

Key claims

Devin Review caught the trojanized axios releases (1.14.1 and 0.30.4) for multiple Cognition customers within ~1 hour of npm publication, before the compromise was publicly known [tweet body].
Wu predicts supply-chain attacks will become “10x more frequent in the age of AI” and argues defensive AI for repo maintainers is now mandatory [tweet body].
The illustrative screenshot shows a Devin Review comment flagging the dependency change as suspicious; specific detection signals (registry-timing anomaly, code-diff heuristics, behavioral analysis) are not enumerated in the tweet [tweet body, image].

Method

Devin Review is Cognition’s automated PR / dependency-change reviewer, layered on the Devin coding-agent stack. Per the tweet it surfaced the malicious axios versions during normal customer PR/dependency review flows — i.e. detection came from an in-loop code-review agent rather than from a dedicated registry scanner. No model, prompt, or detection-rule details are disclosed. The companion screenshot is a single Devin Review comment on a PR introducing the trojanized axios version; the text has been minorly edited for anonymization.

Results

One screenshot of a single Devin Review catch, “within an hour” of malicious release [tweet, image]. No aggregate numbers (true-positive rate, false-positive rate, total Cognition customers protected, comparison vs. Socket / GitHub dependency-graph / Snyk) are disclosed.
Independent reporting (Invictus IR, CyberScoop) confirms the axios compromise was identified within minutes of publication by an Elastic researcher using an AI-powered registry monitor; the trojanized versions delivered a cross-platform RAT with country-aware logic. Devin Review is not the only AI detector that flagged this attack; it is positioned here as the in-repo agent that protected downstream customers.

Why it’s interesting

This is the first artifact on the wiki that positions an agentic-SWE product (Devin) on the defensive security axis rather than the build/test axis covered by Agentic Software Engineering. The benchmark quadruple tracked in that concept page — SWE-Bench Pro / Terminal-Bench 2.0 / OSWorld / GDPval — does not yet include any security-oriented metric; a CVE / supply-chain detection benchmark would be a natural fifth axis. It also extends the closed-loop / model-helps-itself framing in Introducing GPT-5.3-Codex: there, Codex helped build itself; here, an in-the-loop coding agent protects its own customers’ supply chains. Worth noting that the claim is unsubstantiated beyond a single anonymized screenshot — no aggregate metrics, no head-to-head against Socket/Snyk/GitHub dependency review.