Vulnerability management startup Cogent Security Inc. today released VR-1.1, a new version of its frontier reasoning model that writes fixes for newly disclosed software vulnerabilities.
On a public repair benchmark, the model outscored Anthropic PBC’s Claude Code and OpenAI Group PBC’s Codex.
The release goes after the part of vulnerability management that has not sped up. In July, research group Epoch Artificial Intelligence Inc. counted about 2,500 high- and critical-severity disclosures from major organizations, roughly five times the monthly record set before Anthropic announced Claude Mythos Preview in April.
Each repair still needs an engineer who understands the flaw well enough to change the code without breaking something else. Co-founder and Chief Executive Vineet Edupuganti called that stage “where security teams are stuck.”
To test the model on that repair work, Cogent turned to LiveCVEBench. Researchers at Harbin Institute of Technology and Kuaishou Technology built the benchmark from vulnerabilities disclosed in recent months and add new ones regularly. VR-1.1 produced a working repair for 57.9% of the benchmark’s 190 tasks. Claude Code and Codex tied at 45.3%.
Each task drops an agent into a real development environment with a vulnerability report and the affected codebase, in one of 14 programming languages. To pass, a patch has to close the vulnerability without breaking the software, which the benchmark checks with separate security and functionality tests.
Cogent blocked outbound network access during repairs and hid the grading tests until each agent was done. Inference budgets differed across the three systems, according to the full methodology Cogent Research has published.
Where the environment allows, VR-1.1 starts by writing its own proof of concept that triggers the reported flaw. From there the model follows the vulnerability through the affected code, including related paths that share the same weakness. The fix itself stays small, for example checking an index before use.
Every patch goes to a separate review that starts from a fresh context and hunts for a way around the fix. New bugs introduced by the change are part of that check. The model also leaves behind regression tests, which fail if a later code change reopens the flaw. When an attempt fails, the diagnosis and failure details carry into the next try.
“A patch might block the exact payload from a bug report, but leave the same vulnerability open said Geng Sng, co-founder and chief technology officer of Cogent. “We designed VR-1.1 to check its own work for both problems before it finishes.”
Cogent introduced VR-1 in July to find and prove the attack paths an adversary could reach inside an enterprise. The new release extends the remediation capabilities that model introduced.
Founded in 2025, the company sells artificial intelligence agents that detect and fix vulnerabilities, with customers choosing whether a human signs off on each change. According to Cogent, Fortune 500 users have cut the exposure window for critical vulnerabilities by 97%.
Greylock Partners backed its $11 million launch round in July 2025, and Bain Capital Ventures led the $42 million Series A in February that took total funding to $53 million.
Image: Cogent
A message from John Furrier, co-founder of SiliconANGLE:
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
- 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
- 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network
Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from ourMarketplace portal page and links:https://siliconangle.com/aws-marketplace/
About SiliconANGLE Media
SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.
