Cogent releases the latest cutting-edge network security model VR-1.1, ranking first in the LiveCVEBench vulnerability repair testing
Among the 190 recently disclosed CVE, VR-1.1 achieved 57.9% effective repairs; Claude Code and Codex both had a rate of 45.3%.
San Francisco, November 3, 2026 / PRNewswire / -- Today, we release VR-1.1, the latest version of our cutting-edge reasoning model for network security. VR-1.1 ranks among the top in LiveCVEBench. LiveCVEBench is a public benchmark used to test whether AI agents can fix recently disclosed vulnerabilities in real code repositories. Cogent reports that VR-1.1 fixed 57.9% of the 190 tasks in this benchmark, while both Claude Code and Codex achieved 45.3%.
The number of vulnerabilities that security teams are aware of far exceeds the number they are able to fix, and AI has significantly increased the speed at which new vulnerabilities are discovered. According to Cogent, in July, the number of high-risk and critical vulnerabilities disclosed by major software vendors reached five times the monthly record set by Anthropic in April before the announcement of Claude Mythos Preview. Each time a vulnerability is fixed, engineers still need to fully understand it before making modifications to the code without damaging other parts of the system, and this process determines the progress of most vulnerability management projects.
Cogent Security, co-founder and CEO, and Vineet Edupuganti stated: "This year, vulnerabilities are being discovered much more quickly. However, fixing them remains slow, and that's where the security teams are struggling. Every company will need to be able to fix security issues as quickly as AI does, without disrupting the systems on which their businesses depend. We have developed VR-1.1 for this purpose, and on a public benchmark, it fixes more real vulnerabilities than leading general-purpose AI programming tools."
Evaluate based on security and functionality.
LiveCVEBench was created by researchers from Harbin Institute of Technology and Kuaishou Technology. It converts newly disclosed CVE vulnerabilities into repair tasks across 14 programming languages, covering vulnerabilities in injection, access control, configuration, and memory security, and new CVE vulnerabilities will be added regularly. Each task involves deploying a proxy into a real development environment, along with providing vulnerability reports and the affected code repositories.
A patch is only considered to have passed when baseline security tests show that the vulnerabilities have been fixed, and functional tests confirm that the software is still operating as expected. Cogent mentioned that during their evaluation, the external network access was blocked during the repair phase, and no scoring tests were conducted until each proxy was completed. The budget allocated for reasoning processes varied among the three systems.
VR-1.1 How to Complete the Fix
When the environment permits, VR-1.1 will first develop its own proof of concept to trigger the vulnerabilities mentioned in the report. It will trace the propagation path of these vulnerabilities within the affected code, including related paths that share the same weaknesses, and make targeted modifications, such as checking indexes before using them. Subsequently, another round of review will examine the patches in a new context to find ways to bypass the fixes and to determine whether these modifications have introduced new vulnerabilities.
VR-1.1 will also write regression tests to catch any re-emerging vulnerabilities due to subsequent code changes. If one attempt fails, it will carry over the previous diagnostic information and failure details for the next attempt.
Cogent Security, co-founder and chief technology officer, Geng Sng stated: "A patch may prevent the specific payload mentioned in the vulnerability report, but it is still possible for the same vulnerability to remain exposed through another endpoint, or to compromise core user functions. We designed VR-1.1 precisely to check for both types of issues simultaneously before completion. The security team receives a patch that can be reviewed, along with diagnostic and test results."
VR-1.1 has expanded on the remediation capabilities provided by VR-1 which were launched in July by Cogent. VR-1 is a cutting-edge inference model released by the company, designed to identify and prove the potential attack paths that attackers may take within an enterprise. A complete description of Cogent Research, including its methodology, can be found here.
About Cogent Security
Cogent Security is a company that operates under the AI laboratory, focusing on building enterprise platforms for autonomous network defense. Their AI proxy can detect and fix vulnerabilities at machine speed, enabling every enterprise to run its own Cyber Defense Factory securely. Starting from autonomous vulnerability management, they advance from vulnerability disclosure to verified fixes, covering cloud, local, and terminal environments. They can identify exposure areas within minutes and determine the extent to which attackers can penetrate during this process. Customers set the policies that the proxy follows and decide which fixes can be executed autonomously and which require approval. Security teams from Fortune 500 companies that use Cogent have reduced the exposure window for serious vulnerabilities by 97%. Cogent was founded by researchers and operators from Google DeepMind, Abnormal Security, and Coinbase, and is supported by Greylock Partners and Bain Capital Ventures. For more information, please visit cogent.com.
SOURCE Cogent Security
