Cogent Security's VR-1.1 model beats Claude Code and Codex on vulnerability repair
A new frontier reasoning model from Cogent Security achieved a 57.9% success rate fixing software flaws, outperforming Anthropic and OpenAI agents in independent benchmarks.
Cogent Security Inc. today released VR-1.1, an updated version of its frontier reasoning model designed to write fixes for newly disclosed software vulnerabilities. In a public repair benchmark, the model surpassed both Anthropic PBC's Claude Code and OpenAI Group PBC's Codex.
The release highlights progress in the area of vulnerability management that has historically lagged behind other AI advancements. Research group Epoch Artificial Intelligence Inc. counted approximately 2,500 high- and critical-severity disclosures from major organizations in July alone, a figure roughly five times higher than the monthly record set before Anthropic announced Claude Mythos Preview in April.
Despite the surge in disclosures, each repair still requires a human engineer who understands the flaw well enough to modify code without breaking other functionality. Cogent co-founder and Chief Executive Vineet Edupuganti described this stage as "where security teams are stuck."
To evaluate VR-1.1 on this specific remediation work, the company utilized LiveCVEBench, a benchmark constructed by researchers at Harbin Institute of Technology and Kuaishou Technology using vulnerabilities disclosed in recent months with regular updates.
VR-1.1 produced a working repair for 57.9% of the benchmark's 190 tasks, significantly outperforming its competitors.
- Claude Code: 45.3% success rate (tied)
- Codex: 45.3% success rate (tied)
The testing environment simulated real-world conditions by dropping an agent into a live development environment containing a vulnerability report and the affected codebase, available in one of 14 programming languages. To pass a task, the patch had to close the vulnerability without breaking software functionality, verified by separate security and functionality tests.
Cogent implemented strict controls during testing, blocking outbound network access during repairs and withholding grading tests until each agent completed its work. Inference budgets varied across the three systems according to the full methodology published by Cogent Research.
VR-1.1 begins by writing its own proof of concept that triggers the reported flaw, then traces the vulnerability through the affected code and related paths sharing the same weakness. The model keeps fixes small, such as checking an index before use, and leaves behind regression tests to ensure later changes do not reopen the flaw.
"A patch might block the exact payload from a bug report, but leave the same vulnerability open via a different endpoint or break core functionality for users," said Geng Sng, co-founder and chief technology officer of Cogent. "We designed VR-1.1 to check its own work for both problems before it finishes."
Cogent first introduced VR-1 in July to identify and prove the attack paths adversaries could reach inside an enterprise. The new release extends these capabilities specifically toward remediation.
Founded in 2025, Cogent sells artificial intelligence agents that detect and fix vulnerabilities, allowing customers to choose whether a human signs off on each change. According to the company, Fortune 500 users have reduced the exposure window for critical vulnerabilities by 97%.
Greylock Partners backed Cogent's $11 million launch round in July 2025, while Bain Capital Ventures led the $42 million Series A in February that brought total funding to $53 million.
