Jack Cable

Head of Security Products @Cognition. Prev: CEO & Co-founder @Corridor, @CISAgov, @Stanford

[Jack Cable @jackhcable]

Today, Corridor is joining Cognition! Together, we’ll be taking Devin Security to the next level.

We started Corridor almost two years ago with the mission of accelerating secure and autonomous software development. Since then, we’ve seen security go from a niche concern to one of the most pressing issues of our time.

We’re grateful to our team, our customers, our investors, and everyone who’s supported us along the way. We can’t wait to show you what we build next!

[Cognition @cognition]

Today, Cognition is acquiring @corridor.

Securing the world’s software is the most important problem in technology today.

Let’s get to work!

[Cognition @cognition]

Introducing Devin Review 2.0: the best way to review PRs with Devin.

Now up to 5× cheaper, 1.5× faster, and with new features and integrations.

[Jack Cable @jackhcable]

It's been a rough few weeks for security.

I pulled together a guide of the highest-impact actions you can take today: https://t.co/w3QlxkUhhl

[Bella @igarciacamargo]

in 2027, the majority of tokens spent on coding will go towards security. there is no better team to tackle this than @corridor + @cognition.

incredibly proud of you both, @jackhcable and @AshwinRamaswami 💜

[Jack Cable @jackhcable]

Incredible work from the @corridor team!

[Corridor @corridor]

Introducing corridor-argos-1, Corridor’s first security model.

A Qwen 3.5 9B fine-tune that outperforms frontier models including GPT-6 Astra and Claude Opus 5.5 on security context selection, with the lowest time to first token of the 14 models we tested.

Thread 🧵

[Mike Takahashi @TakSec]

We discovered an AI agent swarm targeted a Russian government site by hijacking a remote browser in a scanner tool

They used VNC to remotely control the browser and send keystrokes

More in the blog 👇

[Corridor @corridor]

Coding agents now open PRs and push commits in long-running sessions where humans barely look. Our security enforcement for long-running agents scans every change before the agent commits, but a full scan on every commit is slow and expensive, and many commits are obviously safe. So we put a gate in front of each scan to decide which commits need the full check.

We tested five gates: Jev (a decision model), CLM-8B, and three LLMs prompted for a confidence score.

Jev halved our scanning costs and raised precision with minimal loss in recall. LLM gates helped, but less. CLM-8B off the shelf did not work as a gate.

We wrote up what we learned in our latest blogpost: https://t.co/m9Uzxe6RBF

[Gerrit De Vynck 🦭 @GerritD]

For weeks, the news cycle about AI agents out in the wild has been driven by disclosure after disclosure. But most aren't coming from AI companies. Meet the researchers and hackers who are developing the art and science of hunting down rogue AI agents

https://t.co/1fatFoUaPR

[LangChain @LangChain]

LangSmith for Startups Spotlight: @corridor

@Corridor uses LangSmith to develop + run novel agentic security evaluations, build + trace inference pipelines, and manage memory graphs that provide specialized context across various product surfaces.

Get a demo: https://t.co/wchloWwj34

[Transluce @TransluceAI]

We found several cases where AI agents used aggressive, non-hacking tactics against government websites, including the White House, the Department of War, and several U.S. states. We also found a previously undisclosed hacking attempt against a Canadian government site, which appears to have failed.

Technical report: https://t.co/oE3BbdqsNP
Washington Post: https://t.co/cdIG8ugcUk

[Jack Cable @jackhcable]

Today, @corridor and @TransluceAI are disclosing new evidence of AI agents probing and attempting rudimentary vulnerability exploits against U.S. and Canadian government agencies.

Read more: https://t.co/1h83SA1AkN

[Corridor @corridor]

Today, we're launching Security Enforcement for long-running agents.

Code is written by agents and nobody is watching. Traditional security reviews aren’t built for this approach, but Corridor is. Today we launched Security Enforcement for long-running agents. We built this to keep security in the loop by enforcing your organization’s security guardrails at commit time.

Live for teams on Devin, Claude Code web, Codex, & Cursor: https://t.co/X2lHFpVwK4

[Jack Cable @jackhcable]

Read more on our research:

[Transluce @TransluceAI]

Today’s news that OpenAI hacked the Australian government is not an isolated incident. We’re releasing more than 30,000 logs that include activity from this hack and attempts against previously unknown targets.

In this data, we found rogue agent activity stretching back to at least March, two months earlier than was previously known. This activity continues as recently as last week, suggesting it may still be ongoing 🧵

Our blog: https://t.co/pSojwcXnEK
NYT: https://t.co/OyxnfmAzBN

[Jack Cable @jackhcable]

Notably, these were not cyber benchmarks. Agents, given mundane data retrieval tasks, resorted to attempting to hack sites when they couldn't get the data they needed.

Everyone building AI benchmarks - not just cyber ones - needs to have proper monitoring & sandboxing in place.

[Jack Cable @jackhcable]

The Australian PM revealed that OpenAI's agents hacked their systems yesterday. We discovered this activity several days earlier, thanks to public records of the hacking events on https://t.co/mdzcjJEKik.

[Jack Cable @jackhcable]

NEW: we discover four new cases of rogue agent hacking attempts, which we tie to previously-documented agent swarms from OpenAI. Targets include the Australian government, the University of New Mexico, and several private data hosts.

Collab with @TransluceAI and @corridor.

[Jack Cable @jackhcable]

Google's models hacked into real companies.

While we should be glad that Google's agent didn't cause further harm, I pushed back on the idea that this was business as usual. Agents hacking into real companies is serious and the public deserves to know.

More from @erinkwoo and @bobmcmillan in @WSJ:

[Erin Woo @erinkwoo]

@bobmcmillan Google said it didn't disclose the hacks because they didn't cause harm, and because the models stopped when they realized they accessed real companies. It's part of a broader conversation about how—and when— firms should disclose AI safety/security incidents.

ft @jackhcable

[Erin Woo @erinkwoo]

@bobmcmillan Google said it didn't disclose the hacks because they didn't cause harm, and because the models stopped when they realized they accessed real companies. It's part of a broader conversation about how—and when— firms should disclose AI safety/security incidents.

ft @jackhcable

[aditi nara 🍎 @aditinaraa]

Read my new blog for @corridor on how we evaluated agents on the task of auto-approving our PRs: https://t.co/y0D9qFcC8m

tldr: Luna is goated

[Jack Cable @jackhcable]

Corridor's hitting the road, and we'll be hosting an awesome happy hour ft @JamesBerthoty in NYC on October 15th. Join us!

Details here: https://t.co/kEv68wXTUK