Corridor

Corridor is joining Cognition to build the future of Devin Security.

We’re grateful for the support of our customers, investors, and partners along the way, and we can’t wait to show you what we build next.

AI can save time writing code, but it has the tendency to create more work for the person reviewing it.

At Corridor, we built a skill to help agents write clearer PR descriptions and check them against the code. We’ve shared what worked and the skill itself:

corridor.dev/research/pr-de…

While we were in New York, we hosted a happy hour for security and engineering practitioners to get together and talk about what it takes to secure AI-driven development.

Our CEO @jackhcable shared our recent research on coding agents. A routine support ticket was enough to get agents to run malware and leak secrets. As agents take on more of the work, their own judgment can't be the only guardrail. We also heard from @JamesBerthoty (@latiotech), @Guy_Flechter (@SolaSecurity) and @kylebhiro (@runpensar), on topics ranging from securing coding agents to the limits of LLMs on defense.

A common thread: agents have changed both how code gets written and how it gets attacked, and security has to move closer to where the code is being written.

Our takeaway: the goal isn't to slow agents down. It's to give teams the confidence to let them do more.

Thank you to @SolaSecurity for sponsoring, to our speakers, and to everyone who came out.

Introducing corridor-argos-1, Corridor’s first security model.

A Qwen 3.5 9B fine-tune that outperforms frontier models including GPT-6 Astra and Claude Opus 5.5 on security context selection, with the lowest time to first token of the 14 models we tested.

Thread 🧵

Last week in New York, we brought together a small group of security, AI and engineering leaders from companies including @clay, @figma, @crosbylegal, and Numerix, along with analysts from Latio, for dinner and a candid conversation about the problem everyone is feeling right now: AI is writing code faster than ever, and security hasn't kept up.

A lot of the industry is focused on using AI to find and patch vulnerabilities. Around the table, the view was that this misses the point. Securing existing codebases matters, but if the code agents are writing today isn't secure, teams are creating problems faster than they can fix them.

Our takeaway: autonomous development, done well, should make software stronger, not riskier.

Thanks to everyone who joined us.