Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Security Swarm sends a swarm of parallel Devins through your codebase to build a threat model, hunt down real, exploitable vulnerabilities (even ones chained across files), prove them in a sandbox, and hand you the fix as a pull request. Here's how it works:

Devin Developers

82,543 subscribers

14,846 views • 4 days ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

7 Comments

Devin Developers4 days ago

Try it:

Miguel4 days ago

👀

Trigor4 days ago

Can't wait, great!

Willows ❤️4 days ago

Awesome

Hana Kaito AI🌞4 days ago

This is a really interesting approach to security. Finding vulnerabilities is one thing, but actually proving the exploit and delivering a fix as a PR makes the workflow much more useful.

Mads4 days ago

Cant wait to run this on my own project. Security is the part I trust myself the least with

J ✦4 days ago

people use light mode now?

Related Videos

Introducing Hacktron Review: an AI security reviewer for your pull requests. It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production. Try for free:

Introducing Hacktron Review: an AI security reviewer for your pull requests. It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production. Try for free:

Hacktron AI

73,039 views • 5 months ago

This is like having an army of white hat hackers at your disposal. They break into your app, prove the exploit works, an open a PR that fixes it. It takes about 10 seconds to set up and can be automated to run nightly or weekly for any codebase. In an eval of real and recent vulnerabilities, which the models had never seen, Security Swarm found the bug in 72% of cases, the highest recall of any tool we tested, at ~2/3 the cost of the next most accurate alternative. 🤯 If you have an OSS repo you'd like me to fork and run Security Swarm on, drop a link!

This is like having an army of white hat hackers at your disposal. They break into your app, prove the exploit works, an open a PR that fixes it. It takes about 10 seconds to set up and can be automated to run nightly or weekly for any codebase. In an eval of real and recent vulnerabilities, which the models had never seen, Security Swarm found the bug in 72% of cases, the highest recall of any tool we tested, at ~2/3 the cost of the next most accurate alternative. 🤯 If you have an OSS repo you'd like me to fork and run Security Swarm on, drop a link!

nader dabit

120,361 views • 3 months ago

Devin can now manage a team of Devins. Devin will break down large tasks and delegate them to parallel Devins that each run in their own VM. Over time, Devin gets better at breaking down and managing tasks for your codebase. Available now for all users.

Devin can now manage a team of Devins. Devin will break down large tasks and delegate them to parallel Devins that each run in their own VM. Over time, Devin gets better at breaking down and managing tasks for your codebase. Available now for all users.

Cognition

111,653 views • 6 months ago

OpenAI just released Codex Security, an AI agent that scans software projects to fix vulnerabilities while ignoring harmless bugs. Testing on 1.2mn commits found 792 critical flaws and dropped false alarms by 50%. Here is how the Codex Security agent works Initially, it scans your software project to learn how all the different pieces of code connect. It uses that knowledge to build a threat model, which acts as a custom map showing exactly where your software might be exposed to hackers. The agent then hunts for potential security holes based on that specific map. When it spots a possible flaw, it does not just send you a random alert. Instead, it creates a completely safe and isolated copy of your system known as a sandbox. The agent then actively tries to break into that sandboxed copy to prove if the security weakness is a real danger. If the agent successfully exploits its own test environment, it knows the bug is a genuine threat and not a false alarm. After confirming the danger, the agent writes a custom software patch to fix the broken code. It then tests that new patch to guarantee the fix does not accidentally break any other features in your software.

OpenAI just released Codex Security, an AI agent that scans software projects to fix vulnerabilities while ignoring harmless bugs. Testing on 1.2mn commits found 792 critical flaws and dropped false alarms by 50%. Here is how the Codex Security agent works Initially, it scans your software project to learn how all the different pieces of code connect. It uses that knowledge to build a threat model, which acts as a custom map showing exactly where your software might be exposed to hackers. The agent then hunts for potential security holes based on that specific map. When it spots a possible flaw, it does not just send you a random alert. Instead, it creates a completely safe and isolated copy of your system known as a sandbox. The agent then actively tries to break into that sandboxed copy to prove if the security weakness is a real danger. If the agent successfully exploits its own test environment, it knows the bug is a genuine threat and not a false alarm. After confirming the danger, the agent writes a custom software patch to fix the broken code. It then tests that new patch to guarantee the fix does not accidentally break any other features in your software.

Rohan Paul

13,208 views • 7 months ago

🔥 💻 🎥 How to provide o1 Pro with your FULL CODEBASE through the ChatGPT Cursor connection yesterday I recorded a video connecting o1 Pro to Cursor through the ChatGPT Desktop app more than one person commented on how limiting it is for o1 Pro to only have access to a single open file in Cursor here's a walkthrough of how you can provide o1 Pro with your FULL CODEBASE as context instead of just a single file: 1. Write a Python function that concatenates full codebase into a single snapshot in a .txt file (link in comment) 2. Open that "codebase_snapshot.txt" in a separate Cursor pane 3. Go to the ChatGPT app and ask it what context it has access to through Cursor - should say it has two files with one of them being the codebase snapshot and boom there ya go. o1 Pro has access to everything in your codebase full walkthrough here 👇

🔥 💻 🎥 How to provide o1 Pro with your FULL CODEBASE through the ChatGPT Cursor connection yesterday I recorded a video connecting o1 Pro to Cursor through the ChatGPT Desktop app more than one person commented on how limiting it is for o1 Pro to only have access to a single open file in Cursor here's a walkthrough of how you can provide o1 Pro with your FULL CODEBASE as context instead of just a single file: 1. Write a Python function that concatenates full codebase into a single snapshot in a .txt file (link in comment) 2. Open that "codebase_snapshot.txt" in a separate Cursor pane 3. Go to the ChatGPT app and ask it what context it has access to through Cursor - should say it has two files with one of them being the codebase snapshot and boom there ya go. o1 Pro has access to everything in your codebase full walkthrough here 👇

Dan McAteer

99,787 views • 1 year ago

Announcing Copilot Cowork, a new way to complete tasks and get work done in M365. When you hand off a task to Cowork, it turns your request into a plan and executes it across your apps and files, grounded in your work data and operating within M365’s security and governance boundaries.

Announcing Copilot Cowork, a new way to complete tasks and get work done in M365. When you hand off a task to Cowork, it turns your request into a plan and executes it across your apps and files, grounded in your work data and operating within M365’s security and governance boundaries.

Satya Nadella

9,850,360 views • 7 months ago

Meet Replit Security Agent - providing comprehensive app security reviews in minutes And you get $5 in credits to try it for a limited time Security Agent’s hybrid static analysis and AI-scanning approach is first of its kind: - Acts on custom threat model to review full codebase - Resolves vulnerabilities in parallel using background tasks - Reduces false positives by 90% Powered by Semgrep + @HoundDogAI. Keep vibe coding safely 🔒

Meet Replit Security Agent - providing comprehensive app security reviews in minutes And you get $5 in credits to try it for a limited time Security Agent’s hybrid static analysis and AI-scanning approach is first of its kind: - Acts on custom threat model to review full codebase - Resolves vulnerabilities in parallel using background tasks - Reduces false positives by 90% Powered by Semgrep + @HoundDogAI. Keep vibe coding safely 🔒

Replit ⠕

86,621 views • 5 months ago

July 9th. Our agents live inside your codebase. They find and fix vulnerabilities in real time. You ship multiple times a day. Every push should have rigorous defense behind it, at a price you can afford.

July 9th. Our agents live inside your codebase. They find and fix vulnerabilities in real time. You ship multiple times a day. Every push should have rigorous defense behind it, at a price you can afford.

zauth

12,373 views • 3 months ago

AI can write more code than any team can review by hand, and a pull request can look fine while hiding a security issue or missing a requirement. In our new short course, AI Code Review, built in collaboration with Qodo and taught by Nnenna, you'll learn the practices that make AI code review effective: review before you open a pull request, give the reviewer full context about your codebase, and triage findings by risk. Then you'll build your own review agent, from a context engine that finds the right code to a team of specialized reviewers. Enroll for free:

AI can write more code than any team can review by hand, and a pull request can look fine while hiding a security issue or missing a requirement. In our new short course, AI Code Review, built in collaboration with Qodo and taught by Nnenna, you'll learn the practices that make AI code review effective: review before you open a pull request, give the reviewer full context about your codebase, and triage findings by risk. Then you'll build your own review agent, from a context engine that finds the right code to a team of specialized reviewers. Enroll for free:

DeepLearning.AI

56,896 views • 2 months ago

A Hamas rally at a Jewish synagogue north of Toronto. At 0:17 a masked protester hits a cop. They arrest her but other thugs swarm police, obstruct the arrest and pull her free. Is that how it works in Canada now? Two-tier policing is official policy.

A Hamas rally at a Jewish synagogue north of Toronto. At 0:17 a masked protester hits a cop. They arrest her but other thugs swarm police, obstruct the arrest and pull her free. Is that how it works in Canada now? Two-tier policing is official policy.

Ezra Levant 🍁🚛

859,807 views • 2 years ago

Introducing Oasis: the first playable AI-generated game. We partnered with Decart to build a real-time, interactive world model that runs >10x faster on Sohu. We're open-sourcing the model architecture, weights, and research. Here's how it works (and a demo you can play!):

Introducing Oasis: the first playable AI-generated game. We partnered with Decart to build a real-time, interactive world model that runs >10x faster on Sohu. We're open-sourcing the model architecture, weights, and research. Here's how it works (and a demo you can play!):

Etched

24,721,573 views • 1 year ago

CL.TE request smuggling works when front-end and back-end disagree on where your request ends. The attacker hides a second request in the body of the first. Here's a demo 👇 Practice with PortSwigger's Web Security Academy.

CL.TE request smuggling works when front-end and back-end disagree on where your request ends. The attacker hides a second request in the body of the first. Here's a demo 👇 Practice with PortSwigger's Web Security Academy.

Web Security Academy

17,936 views • 3 months ago

Marvin Minsky, the MIT scientist who founded AI: "Citadel pays PhDs $500K to find the perfect equation. The market doesn't have one. It's beaten by a swarm of dumb agents, the exact design Marvin Minsky said your brain runs on." the thread above is about swarm intelligence, letting a crowd of simple agents search the ugly, shifting landscape of a market that no clean equation can solve. minsky's entire life's work says that isn't a hack. it is how intelligence itself is built. he proved you don't need a smart central solver. you need many mindless specialists, each doing one tiny job, none understanding the whole. connect enough of them and something intelligent emerges from parts that are individually dumb. a market is exactly that: millions of simple agents, no one in charge, collectively solving a problem none of them can see. that is why the swarm beats the elegant math. a single closed-form equation assumes a clean, stable world. the market is nonlinear, non-stationary, full of traps. a swarm doesn't need to understand the landscape, it explores it from a thousand angles at once and can't get permanently stuck where one clever model would. minsky saw this in the mind decades before quants borrowed it for markets. he taught it at MIT, for free, in this lecture. same story i keep telling: the "new" AI idea running the funds is an old idea in a new wrapper. here is what the thread underplays, and minsky knew it. a swarm is only as good as how its agents are wired and rewarded. connect them wrong and a thousand dumb agents don't become a genius, they become expensive noise that overfits and blows up. the swarm is free. the architecture, knowing how to connect and constrain the agents, is the entire edge.

Marvin Minsky, the MIT scientist who founded AI: "Citadel pays PhDs $500K to find the perfect equation. The market doesn't have one. It's beaten by a swarm of dumb agents, the exact design Marvin Minsky said your brain runs on." the thread above is about swarm intelligence, letting a crowd of simple agents search the ugly, shifting landscape of a market that no clean equation can solve. minsky's entire life's work says that isn't a hack. it is how intelligence itself is built. he proved you don't need a smart central solver. you need many mindless specialists, each doing one tiny job, none understanding the whole. connect enough of them and something intelligent emerges from parts that are individually dumb. a market is exactly that: millions of simple agents, no one in charge, collectively solving a problem none of them can see. that is why the swarm beats the elegant math. a single closed-form equation assumes a clean, stable world. the market is nonlinear, non-stationary, full of traps. a swarm doesn't need to understand the landscape, it explores it from a thousand angles at once and can't get permanently stuck where one clever model would. minsky saw this in the mind decades before quants borrowed it for markets. he taught it at MIT, for free, in this lecture. same story i keep telling: the "new" AI idea running the funds is an old idea in a new wrapper. here is what the thread underplays, and minsky knew it. a swarm is only as good as how its agents are wired and rewarded. connect them wrong and a thousand dumb agents don't become a genius, they become expensive noise that overfits and blows up. the swarm is free. the architecture, knowing how to connect and constrain the agents, is the entire edge.

Rossst.03

45,487 views • 2 months ago

Most AI agents work alone. Today, @convergence_ai_ just leveled up again with `Parallel Agents`: A swarm-style system that splits your task into sub-tasks, spins up multiple agents (each in its own browser!), and completes complex work in seconds. Here’s how it works. ↓

Most AI agents work alone. Today, @convergence_ai_ just leveled up again with `Parallel Agents`: A swarm-style system that splits your task into sub-tasks, spins up multiple agents (each in its own browser!), and completes complex work in seconds. Here’s how it works. ↓

Charly Wargnier ☄️

55,873 views • 1 year ago

I put an entire codebase in a text file and gave it to Gemini 1.5 Pro. I gave it a task that required updating ~10 files across the entire codebase - so decently complex. It got about 80% of the work done for me on a 1st attempt. Watch to see in-depth on how it performed.

I put an entire codebase in a text file and gave it to Gemini 1.5 Pro. I gave it a task that required updating ~10 files across the entire codebase - so decently complex. It got about 80% of the work done for me on a 1st attempt. Watch to see in-depth on how it performed.

Mckay Wrigley

85,751 views • 2 years ago

I'm blown away. Ornith-1.0 35b is the best local model I've ever run that doesn't require 200GB+ of RAM Incredible at coding According to my tests it's both smarter and faster than Qwen 3.6 Plus it runs like a dream on a DGX Spark Here's how I'm using it: I have it running every hour and looping through different parts of my Henry Intelligent Machines codebase It looks for security vulnerabilities Any vulnerabilities it finds, it writes a report with the fix Then once a day another loop I have running in Codex reads the report with all the security bugs and verifies, then fixes I also have it once a day going through a reviewing all my open PRs Local models running on loops 24/7 is the future. I promise you What's becoming possible today with local models is truly mind blowing

I'm blown away. Ornith-1.0 35b is the best local model I've ever run that doesn't require 200GB+ of RAM Incredible at coding According to my tests it's both smarter and faster than Qwen 3.6 Plus it runs like a dream on a DGX Spark Here's how I'm using it: I have it running every hour and looping through different parts of my Henry Intelligent Machines codebase It looks for security vulnerabilities Any vulnerabilities it finds, it writes a report with the fix Then once a day another loop I have running in Codex reads the report with all the security bugs and verifies, then fixes I also have it once a day going through a reviewing all my open PRs Local models running on loops 24/7 is the future. I promise you What's becoming possible today with local models is truly mind blowing

Alex Finn

315,163 views • 3 months ago

GREAT DEAL❗️ As an expert in international relations, I’m a bit confused, because… a swarm of drones launched by Russia attacking Kyiv right now, I hear the explosions from air defense, and a ballistic threat from the east. ❓Or was this really how it was supposed to go?

GREAT DEAL❗️ As an expert in international relations, I’m a bit confused, because… a swarm of drones launched by Russia attacking Kyiv right now, I hear the explosions from air defense, and a ballistic threat from the east. ❓Or was this really how it was supposed to go?

Maria Drutska 🇺🇦

200,694 views • 1 year ago

lee from cursor JUST showed me the future of coding in this 29 min tutorial. what if instead of thinking about coding as you sitting alone in front of a screen , you started to think about it as you and a swarm of agents each taking on very specific roles, each showing up exactly when you need them, each running in the background without ever needing a coffee break. imagine a bugbot that doesn’t just review your pull request but triages the issue instantly, leaves intelligent comments, and in some cases even proposes a fix before a teammate has had the chance to read the description. imagine a security agent that quietly scans your code for vulnerabilities and flags them long before they become liabilities. imagine an agent dedicated to software culture, enforcing the little rules your team has decided matter, whether that’s never skipping loading states, banning certain lazy marketing phrases in your code comments, or making sure tests are always included. lee walked me through how all of this already exists inside cursor. he spun up custom commands like /code-review or /security-review that behave less like toys and more like trusted coworkers who have internalized the way your team thinks about quality. and when he combined that with rails, type safety, linters, formatting rules, test suites.... the agents learned to check themselves against the rails and fix mistakes automatically. you end up with a system where the codebase begins to feel alive, constantly watching itself, constantly healing. another thing i learned from lee was watching how he doesn’t pile everything into one giant context and hope for magic. he creates new chats for every new task, sometimes twenty or more in a single day, each one a fresh brain that isn’t bogged down by yesterday’s details. it’s a discipline that keeps the agents sharp and the outputs clean. pro tip, thanks Lee Robinson. this was a cool glimpse into the future of coding and some tips on how to squeeze the most out of cursor. anything is possible.

lee from cursor JUST showed me the future of coding in this 29 min tutorial. what if instead of thinking about coding as you sitting alone in front of a screen , you started to think about it as you and a swarm of agents each taking on very specific roles, each showing up exactly when you need them, each running in the background without ever needing a coffee break. imagine a bugbot that doesn’t just review your pull request but triages the issue instantly, leaves intelligent comments, and in some cases even proposes a fix before a teammate has had the chance to read the description. imagine a security agent that quietly scans your code for vulnerabilities and flags them long before they become liabilities. imagine an agent dedicated to software culture, enforcing the little rules your team has decided matter, whether that’s never skipping loading states, banning certain lazy marketing phrases in your code comments, or making sure tests are always included. lee walked me through how all of this already exists inside cursor. he spun up custom commands like /code-review or /security-review that behave less like toys and more like trusted coworkers who have internalized the way your team thinks about quality. and when he combined that with rails, type safety, linters, formatting rules, test suites.... the agents learned to check themselves against the rails and fix mistakes automatically. you end up with a system where the codebase begins to feel alive, constantly watching itself, constantly healing. another thing i learned from lee was watching how he doesn’t pile everything into one giant context and hope for magic. he creates new chats for every new task, sometimes twenty or more in a single day, each one a fresh brain that isn’t bogged down by yesterday’s details. it’s a discipline that keeps the agents sharp and the outputs clean. pro tip, thanks Lee Robinson. this was a cool glimpse into the future of coding and some tips on how to squeeze the most out of cursor. anything is possible.

GREG ISENBERG

47,221 views • 1 year ago

🚨🇺🇸🇮🇷 IRAN’S DRONE SWARM IS STILL VERY MUCH ALIVE Retired Navy Senior Chief Malcolm Nance challenges the “we’ve degraded them” narrative: even after heavy strikes, Iran still has tens of thousands of drones ready to go. He says Tehran has proven it can absorb everything short of nuclear war. The U.S. can bomb runways and factories, but you can’t easily bomb 50,000 hidden drones in a country the size of Iran. The swarm threat remains very real. Malcolm Nance

🚨🇺🇸🇮🇷 IRAN’S DRONE SWARM IS STILL VERY MUCH ALIVE Retired Navy Senior Chief Malcolm Nance challenges the “we’ve degraded them” narrative: even after heavy strikes, Iran still has tens of thousands of drones ready to go. He says Tehran has proven it can absorb everything short of nuclear war. The U.S. can bomb runways and factories, but you can’t easily bomb 50,000 hidden drones in a country the size of Iran. The swarm threat remains very real. Malcolm Nance

Mario Nawfal

101,666 views • 6 months ago