Devin Split Into Three Products in June. One Stayed Vulnerable Until August.

Cognition renamed its Windsurf IDE to Devin Desktop on June 2, 2026, and the rebranded product went 24 days after a July 8 vulnerability disclosure without a fix.

August 1 is when that fix landed. It closed a hole that let a booby-trapped repository trick an agent into overwriting a file it was never shown, an SSH key among the real examples, while the approval dialog on screen kept displaying an innocent filename.

Devin itself, the cloud-hosted coding agent Cognition still sells under that name alone, runs on a separate architecture and was not part of that vulnerable set. A developer typing "Devin" into a search bar today is choosing between at least two products with two different security records, not one. For a founding engineer at a four or five person startup about to grant either one write access to a real repository, that distinction is most of the decision.

devin.ai after the June rename — one brand now fronting the cloud agent, the desktop IDE and the enterprise tier this piece separates. Captured 17 Aug 2026.

What actually changed

Cognition agreed to acquire Windsurf in July 2025, TechCrunch reported at the time. The rebrand itself waited nearly a year: version 3.0.1012 shipped on June 2, 2026, and the changelog entry reads simply, "Windsurf is now Devin Desktop."

A week after that, version 3.1.1005 renamed the CLI settings section to Devin Local. Version 3.3.1009, on June 19, extended the new branding to the Windows installer. Type windsurf.com into a browser now and it returns an HTTP 308 redirect straight to devin.ai.

So there are three names doing three jobs. The IDE that Cascade used to power is now Devin Local. The desktop app around it is Devin Desktop. The original web-hosted agent, built on unrelated code, is still just plain Devin.

A bug that was already public when the rename landed

Security firm Wiz disclosed a flaw it named GhostApproval on July 8, 2026, five weeks after the rebrand. The pattern hit six AI coding assistants: Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf, the last already wearing its Devin Desktop name by the time the report went out.

The mechanism combines two flaws. A malicious repository can plant a symlink disguised as something ordinary, project_settings.json in Wiz's own example, that actually points at a sensitive file such as a developer's SSH key. When the agent is asked to set up the workspace, it follows the link.

The approval prompt shown to a developer names the harmless-looking file, never the real target. So a developer approves an edit they cannot actually see.

The patch scoreboard, dated

Three vendors moved before disclosure forced their hand. AWS fixed the Amazon Q Developer language server in version 1.69.0, filed as CVE-2026-12958. Google patched Antigravity on May 22. Cursor's fix shipped June 5 in version 3.0, under CVE-2026-50549, weeks ahead of the public disclosure.

Devin Desktop trailed all three. Its fix arrived in version 3.6.1027 on August 1, and the changelog states plainly that the edit, write, apply_patch and notebook_edit tools "now refuse to write through a symlink." Anthropic took a different position, calling the behavior outside its threat model rather than a bug, though current Claude Code releases add a warning when a symlink turns up. Augment has acknowledged the report and, as of this writing, still has not shipped a fix.

Who it helps

Cursor and AWS now have a real number to cite in any security review: a patch that landed weeks before a researcher went public, with a CVE attached. That is the kind of before-and-after story a procurement team asks for, and neither Devin Desktop nor Augment can currently match it.

Who it hurts

Cognition, mostly on timing. The month it chose to consolidate its consumer brand around the single name "Devin" was the same month a five-week-old rebrand carried an unpatched file-write bug into wider view.

Anyone who researched "what is Devin" between June 2 and August 1 got an answer built on a name that, for part of that window, pointed at an unpatched product without saying so. It is also a quiet gift to GitHub: every agentic coding tool chasing Copilot's seats is implicitly arguing it deserves more autonomy on a real codebase, and a multi-vendor scramble to patch a sandbox-escape bug is not the evidence that argument needed this quarter.

The turn

The obvious objection: the patch shipped August 1, so this is solved, and writing about it in mid-August is stale. That is fair as far as it goes, but it skips two things.

First, the 24-day gap between disclosure and fix happened after the product had already been folded into Cognition's primary brand, not before, so the exposure sat under the more visible name. Second, patching one instance does not resolve the pattern: Augment is still open, and the dispute over Claude Code's behavior remains unresolved. A reader deciding whether to trust an agentic tool with file-write access is not choosing a moment in time. They are choosing a track record on this exact class of bug.

What to watch

Augment is now the only one of the six tested tools without a shipped fix. Watch whether that changes before September 30, 2026, when the third quarter closes. A six to eight week gap between disclosure and patch has been the norm across this group, and past that, the usual pattern in security research is a public follow-up post naming names.

A team that would rather sidestep the whole timeline can also look at agentic tools outside that six, Sourcegraph's Cody among them, though an absence of findings is not the same as a clean bill of health. Separately, watch whether the older name disappears entirely from Cognition's own documentation, or whether one brand keeps stretching across products with genuinely different code underneath.

None of this makes Devin Desktop unsafe today. The symlink hole is closed. What it means is that the name alone no longer tells a reader which product, or which security record, they are actually getting.

The next time a GhostApproval-shaped bug turns up in an agentic coding tool, the first question worth asking is not which vendor got hit. It is which of the things currently called Devin is actually running on the machine in front of you.

Frequently asked questions

What is the difference between Devin and Devin Desktop?

Devin is Cognition's original cloud-hosted autonomous coding agent, launched in March 2024, that runs tasks inside its own sandboxed virtual machine. Devin Desktop is the product formerly known as Windsurf, an AI-native IDE that Cognition acquired in July 2025 and renamed on June 2, 2026. The two run on different codebases with different security histories, even though they now share a brand name.

Was Devin itself affected by the GhostApproval vulnerability?

No. Wiz's disclosure named six coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf, the last of which had already been renamed Devin Desktop. Cognition's original cloud-based Devin agent was not on that list, though that only means it was not part of the tested set, not that it was independently verified safe.

When did Devin Desktop fix the GhostApproval bug?

Cognition shipped the fix in version 3.6.1027 on August 1, 2026, according to Devin's own changelog. The update made the edit, write, apply_patch, and notebook_edit tools in Devin Local refuse to write through a symlink, closing the gap between what the approval dialog showed and what the agent actually touched.

Which AI coding assistants still have not patched GhostApproval?

As of this writing, Augment has acknowledged the report but has not shipped a fix. Anthropic's Claude Code disputes that the behavior is a bug at all, calling it outside its threat model, though later versions added a warning when a symlink is detected.

How much does Devin cost in 2026?

Devin's Core plan starts at $20 a month plus $2.25 per Agent Compute Unit, roughly 15 minutes of autonomous work, according to Cognition. That replaced an earlier $500-only entry point, close to a 96% drop in the minimum monthly cost.

Covered in this guide

• Devin: Devin is Cognition's autonomous AI software engineer that plans, codes, tests, and ships PRs from $20/month plus per-task Agent Compute Unit billing.
• Windsurf: Windsurf is an agentic AI IDE by Cognition AI featuring Cascade agents, Codemaps, and integrated Devin cloud workflows — used by developers in 70+ languages, starting free with Pro at $20/month.
• AWS: Amazon Web Services (AWS), launched 2006, is the world's largest cloud platform: $128.7B FY2025 revenue, roughly 29% global market share, and 200+ services.
• Claude Code: Claude Code by Anthropic scores 88.6% on SWE-bench Verified, starts at $20/month with no free tier. Reads 1M-token codebases, edits files, runs tests, and opens PRs across 8 platforms.
• Cursor: Cursor is an AI code editor built on VS Code, used by 64% of Fortune 500 companies, with Agent Mode, Tab completion, and Cloud Agents at $20/month.
• GitHub: Founded in 2008, GitHub is the largest code repository and collaboration platform with 140M+ developers, now integrated into Microsoft's CoreAI division after CEO Thomas Dohmke departed end of 2025.
• Sourcegraph: Enterprise-only code intelligence platform with AI assistant Cody for cross-repository semantic search and context-aware code understanding at scale. Free/Pro plans discontinued July 2025.

Sources

• GhostApproval: A Trust Boundary Gap in AI Coding Assistants
• GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
• Devin Desktop Changelog
• Cognition, maker of the AI coding agent Devin, acquires Windsurf
• SWE-bench technical report
• Devin Pricing 2026: Real Costs, ACUs & Alternatives