Cogent Unveils VR-1.1, Its Latest Frontier Cyber Model, Which Tops LiveCVEBench for Vulnerability Repair

On 190 recently disclosed CVEs, VR-1.1 produced working repairs for 57.9%, compared with 45.3% for both Claude Code and Codex.

SAN FRANCISCO, Nov. 3, 2026 /PRNewswire/ -- Cogent Security today released VR-1.1, the latest version of its frontier reasoning model for cybersecurity. VR-1.1 tops LiveCVEBench, a public benchmark that tests whether AI agents can repair recently disclosed vulnerabilities in real codebases. It repaired 57.9% of the benchmark's 190 tasks, compared with 45.3% for both Claude Code and Codex.

Security teams already know about more vulnerabilities than they can fix, and AI has sharply increased the rate at which new ones are found. In July, high- and critical-severity disclosures from major software makers hit five times the monthly record set before Anthropic announced Claude Mythos Preview in April. Each repair still depends on an engineer who has to understand the flaw well enough to change the code without breaking anything else, and that work sets the pace for most vulnerability programs.

"Finding vulnerabilities got a lot faster this year. Fixing them is still slow, and that's where security teams are stuck," said Vineet Edupuganti, co-founder and CEO of Cogent Security. "Every company is going to need AI that can fix security problems as fast as AI finds them, without breaking the systems the business runs on. We built VR-1.1 for that work, and on a public benchmark it fixed more real vulnerabilities than the leading general-purpose AI coding tools."

Graded on Security and Function

LiveCVEBench was created by researchers at Harbin Institute of Technology and Kuaishou Technology. It turns newly disclosed CVEs into repair tasks across 14 programming languages and a mix of injection, access-control, configuration and memory-safety flaws, and it adds new CVEs regularly. Each task places an agent in a real development environment with a vulnerability report and the affected codebase.

A patch passes only if the benchmark's security tests show the vulnerability is closed and its functionality tests show the software still works as intended. In Cogent's evaluation, outbound network access was blocked during the repair phase, and the grading tests were withheld until each agent finished. Inference budgets differed across the three systems.

How VR-1.1 Works Through a Repair

Where the environment allows, VR-1.1 starts by writing its own proof of concept that triggers the reported flaw. It traces the vulnerability through the affected code, including related paths that share the same weakness, and makes a focused change, such as checking an index before use. A separate review then examines the patch in a fresh context, looking for ways around the fix and for bugs the change introduced.

VR-1.1 also writes regression tests that catch the bug if a later code change brings it back. When an attempt fails, it carries the earlier diagnosis and failure details into the next one.

"A patch might block the exact payload from a bug report, but leave the same vulnerability open via a different endpoint or break core functionality for users," said Geng Sng, co-founder and CTO of Cogent Security. "We designed VR-1.1 to check its own work for both problems before it finishes. Security teams get a patch they can inspect, with the diagnosis and test results alongside it."

VR-1.1 extends the remediation capabilities Cogent introduced with VR-1, the frontier reasoning model it released in July to find and prove the attack paths an adversary could reach inside an enterprise. Cogent Research's full write-up, including methodology, can be found here.

About Cogent Security

Cogent Security is an applied AI lab building the enterprise platform for autonomous cyber defense. Its AI agents find and fix vulnerabilities at machine speed so every enterprise can run its own Cyber Defense Factory. Starting with autonomous vulnerability management, Cogent carries vulnerabilities from disclosure to a verified fix across cloud, on-premises, and endpoint environments, identifying exposure within minutes and confirming what attackers can reach along the way. Customers set the policies the agents follow and decide which fixes run autonomously and which wait for approval. Fortune 500 security teams using Cogent have reduced the exposure window for critical vulnerabilities by 97 percent. Built by researchers and operators from Google DeepMind, Abnormal Security, and Coinbase, Cogent is backed by Greylock Partners and Bain Capital Ventures. Learn more at cogent.com.

SOURCE Cogent Security