Vulnerability management startup Cogent Security Inc. today released VR-1.1, a new version of its frontier reasoning model that writes fixes for newly disclosed software vulnerabilities.
On a public repair benchmark, the model outscored Anthropic PBC’s Claude Code and OpenAI Group PBC’s Codex.
The release goes after the part of vulnerability management that has not sped up. In July, research group Epoch Artificial Intelligence Inc. counted about 2,500 high- and critical-severity disclosures from major organizations, roughly five times the monthly record set before Anthropic announced Claude Mythos Preview in April.
Each repair still needs an engineer who understands the flaw well enough to change the code without breaking something else. Co-founder and Chief Executive Vineet Edupuganti called that stage “where security teams are stuck.”
To test the model on that repair work, Cogent turned to LiveCVEBench. Researchers at Harbin Institute of Technology and Kuaishou Technology built the benchmark from vulnerabilities disclosed in recent months and add new ones regularly. VR-1.1 produced a working repair for 57.9% of the benchmark’s 190 tasks. Claude Code and Codex tied at 45.3%.
Each task drops an agent into a real development environment with a vulnerability report and the affected codebase, in one of 14 programming languages. To pass, a patch has to close the vulnerability without breaking the software, which the benchmark checks with separate security and functionality tests.
Cogent blocked outbound network access during repairs and hid the grading tests until each agent was done. Inference budgets differed across the three systems, according to the full methodology Cogent Research has published.
Where the environment allows, VR-1.1 starts by writing its own proof of concept that triggers the reported flaw. From there the model follows the vulnerability through the affected code, including related paths that share the same weakness. The fix itself stays small, for example checking an index before use.
Every patch goes to a separate review that starts from a fresh context and hunts for a way around the fix. New bugs introduced by the change are part of that check. The model also leaves behind regression tests, which fail if a later code change reopens the flaw. When an attempt fails, the diagnosis and failure details carry into the next try.
“A patch might block the exact payload from a bug report, but leave the same vulnerability open via a different endpoint or break core functionality for users,” said Geng Sng, co-founder and chief technology officer of Cogent. “We designed VR-1.1 to check its own work for both problems before it finishes.”
Cogent introduced VR-1 in July to find and prove the attack paths an adversary could reach inside an enterprise. The new release extends the remediation capabilities that model introduced.
Founded in 2025, the company sells artificial intelligence agents that detect and fix vulnerabilities, with customers choosing whether a human signs off on each change. According to Cogent, Fortune 500 users have cut the exposure window for critical vulnerabilities by 97%.
Greylock Partners backed its $11 million launch round in July 2025, and Bain Capital Ventures led the $42 million Series A in February that took total funding to $53 million.