Goldman Sachs Pioneers Devin AI Software Engineering Agent: Vulnerability Fix Time Drops from 30 to 1.5 Minutes, PR Acceptance Rate Rises from One-Third to Two-Thirds

Introduction

Goldman Sachs has become the world's first major financial institution to deploy an autonomous AI software engineering agent for real production tasks. By introducing Devin, an AI agent developed by startup Cognition, Goldman Sachs's approximately 12,000 human engineers have gained a "digital colleague" — an autonomous AI system capable of independently completing code writing, testing, debugging, and system migration. This deployment has not only brought significant efficiency improvements but has also sparked deep reflection in the financial industry about AI agents' roles in core business operations.

Why Did Goldman Sachs Choose Devin?

Against the backdrop of AI-assisted coding tools (like GitHub Copilot) already being widely adopted, Goldman Sachs chose Devin for its agentic qualities:

Traditional AI Coding Assistants (like Copilot): Provide code snippet suggestions, requiring human engineers to lead the entire development process.

Devin (Autonomous AI Agent): Can independently complete end-to-end workflows, including:

• Autonomously understanding and decomposing complex tasks
• Setting up development environments
• Writing, testing, and debugging code
• Reproducing and fixing bugs in production environments
• Submitting code for human review

Goldman Sachs CIO Marco Argenti described this transformation as moving from "tracking adoption metrics" to "monitoring the speed at which ideas become working production models," colorfully calling it "3D printing software."

Quantified Results: Impressive Efficiency Improvements

Vulnerability Fix Speed

• Before: Average of 30 minutes per vulnerability
• After using Devin: Reduced to approximately 1.5 minutes
• Improvement: 20x speed increase

Code Quality Improvement

• Initially: Approximately one-third of Devin-generated Pull Requests (PRs) were directly accepted by human reviewers
• After maturation: Acceptance rate improved to approximately two-thirds
• Significance: As Devin became more familiar with Goldman Sachs's codebase and standards, its output quality continuously improved

Overall Productivity

Goldman Sachs's CIO stated that Devin is expected to deliver 3-4 times the productivity improvement of traditional AI tools — a figure far exceeding market expectations.

Primary Use Case: Legacy System Modernization

Goldman Sachs's primary task for deploying Devin is legacy architecture modernization — a major challenge commonly faced by financial institutions:

• Code translation: Converting legacy code (such as COBOL, older Java) to modern languages
• System migration: Migrating legacy systems to modern cloud architectures
• Documentation generation: Automatically generating technical documentation for undocumented legacy code
• Test coverage: Adding automated tests for legacy code

These tasks are typically time-consuming and unappealing to human engineers, making them ideal scenarios where AI agents can deliver the most value.

"Hybrid Workforce" Model: New Paradigm for Human-AI Collaboration

Goldman Sachs's Devin deployment adopts what Marco Argenti calls the "Hybrid Workforce" model:

Human Engineers' Role Transformation:

• From executing repetitive coding tasks → to higher-value architecture design and business logic
• From code producers → to reviewers and quality gatekeepers of AI output
• From individual contributors → to "managers" of AI agents

Devin's Scope of Responsibilities:

• Handling clearly defined, repeatable coding tasks
• Executing end-to-end workflows under human supervision
• Submitting work results for final human approval

The key to this model is preserving human leadership in critical decisions while maximizing AI agent efficiency at the execution level.

Future Expansion Plans: Extending to Core Financial Operations

Following Devin's successful deployment, Goldman Sachs plans to further expand AI agent applications:

Anthropic Claude Integration: Plans to introduce Claude to assist with functions closer to core financial operations, including:

• Trade and transaction processing
• Client due diligence and onboarding processes
• Risk assessment and compliance review

This plan indicates that Goldman Sachs's AI agent strategy extends beyond the technology department, gradually penetrating into the business core.

Industry Impact: Demonstration Effect for Financial Sector AI Agents

Goldman Sachs's successful deployment is generating widespread attention across the financial industry:

Deutsche Bank and DBS: Have begun adopting regulated agentic platforms, focusing on auditability and strict approval flows, particularly for scenarios like corporate credit memo drafting.

McKinsey Research: 32% of organizations are bypassing traditional software purchases in favor of building internal tools through agentic coding agents — a trend particularly pronounced in the financial industry.

Bloomberg Intelligence Warning: Estimates that up to 200,000 banking jobs in the United States face risk, with junior developer positions particularly vulnerable.

Insights for Asia-Pacific Financial Institutions

Singapore Financial Industry

The Monetary Authority of Singapore (MAS) has issued AI governance frameworks, providing regulatory guidance for financial institutions deploying AI agents. Local banks like DBS are actively exploring AI agent applications in customer service and back-office operations.

Hong Kong Financial Industry

The Hong Kong Monetary Authority's (HKMA) "regulatory sandbox" mechanism provides testing space for fintech innovation. Goldman Sachs's Devin deployment case provides an important practical reference for Hong Kong's banking industry.

Japanese Financial Industry

Japan's Financial Services Agency (FSA) takes a cautious but open stance toward AI applications in finance. Major banks like MUFG and Mizuho are evaluating AI agents' potential in legacy system modernization.

Chinese Financial Industry

China's fintech regulatory environment is relatively complex, but major banks like ICBC and China Merchants Bank have extensive experience in AI applications, and Goldman Sachs's case provides useful reference.

Deep Reflection on Workforce Impact

Goldman Sachs's Devin deployment has sparked profound discussions about the future of the financial industry workforce:

Short-term Impact: Junior developer positions face the most direct impact, as Devin excels precisely at these structured, repeatable coding tasks.

Long-term Impact: Entry-level positions have historically served as the training ground for senior engineers. The widespread adoption of AI agents may disrupt this talent development pipeline, long-term affecting the industry's technical talent reserves.

Goldman Sachs's Position: Company leadership frames Devin as a "human augmentation" tool, emphasizing freeing employees to focus on higher-value complex problems rather than replacing human engineers.

Conclusion

Goldman Sachs's Devin deployment case represents an important milestone in financial industry AI agent applications. The quantified results — vulnerability fix time dropping from 30 minutes to 1.5 minutes, PR acceptance rate rising from one-third to two-thirds — fully demonstrate the practical value of autonomous AI agents in enterprise production environments.

For Asia-Pacific financial institutions, Goldman Sachs's experience provides a valuable practical blueprint: start with legacy system modernization, establish a "hybrid workforce" model of human-AI collaboration, and gradually extend to core business operations. Against the backdrop of rapidly maturing AI agent technology, financial institutions that act first will gain significant advantages in efficiency and competitiveness.