Coding agent Devin cuts bank migration times to weeks at Nubank; discloses no audit trail, compliance certification or insurance terms

Devin, an autonomous software-engineering agent, says a business at Nubank "completed their migrations in weeks instead of months or years" using the product, according to its website. The company describes Devin's core workflow as ships PRs the way a development team does: it "ships PRs the way your team does — picking up review feedback and CI results to get each PR approved and merged."

The vendor frames the product for large, structured jobs specifically. "Migration or large refactoring tasks are often fantastic projects for Devin: after investing a small, fixed cost to teach Devin how to approach sub-tasks, Devin can go and complete the migration autonomously," the company says. For bigger jobs, it says Devin "can spin up a team of Devins for large tasks."

Nubank supplied its own historical work to improve the product. "The Nubank team helped to collect examples of previous migrations their engineers had done manually, some of which were fed to Devin for fine-tuning," the company says. Measured against its own evaluation set, the vendor reports "we observed a doubling of Devin's task completion scores after fine-tuning" — a result measured by the vendor, not verified by an independent evaluator.

Oversight is limited to approval rather than a runtime restriction. The company says "a human is kept in the loop just to manage the project and approve Devin's changes," but no scope, spend or authority limit enforced on the agent at run time is published, and no audit-trail, logging or record-keeping mechanism appears on the page reviewed.

An AI Dispatch review of Devin's public disclosures found no compliance certification, no audit-trail mechanism, no insurance carrier, coverage limit or customer indemnity, and no settlement mechanism tying payment to a verified outcome — a gap across all five dimensions of the trust-gap rubric this outlet applies to agentic AI products, on a tool now performing production engineering work inside a regulated financial institution.

AI Dispatch found no evidence Devin misrepresents its own capabilities; the finding is what a product doing engineering work inside a bank discloses about oversight and liability if that work goes wrong.