Cogent’s VR-1.1 model fixed 57.9% of vulnerabilities

VR-1.1 takes the lead on LiveCVEBench

Cogent Security announced VR-1.1 on November 3, 2026, the latest version of its advanced reasoning model developed for cybersecurity. According to the company, the model produced working fixes for 57.9% of 190 recently disclosed CVE vulnerabilities in the LiveCVEBench test.

By comparison, Claude Code and Codex both achieved a rate of 45.3%. The results come from Cogent’s own evaluation. The company said the three systems used different reasoning frameworks, so the comparison takes that factor into account.

LiveCVEBench was developed by researchers at Harbin Institute of Technology and Kuaishou Technology. The public evaluation turns newly disclosed CVEs into repair tasks across 14 programming languages, covering issues including injection, access control, configuration and memory safety vulnerabilities.

Both security and functionality count in a fix

The benchmark places the agent in a real development environment for every task. The agent receives a vulnerability report and the affected codebase, then produces a fix. A fix is successful only if security tests confirm that the flaw has been eliminated and functional tests show that the software continues to work as intended.

In Cogent’s evaluation, outbound network access was disabled during the repair phase, while the tests used for scoring remained unavailable until the agent had completed its work. LiveCVEBench regularly adds new CVEs to its tasks.

According to the company, vulnerability discovery has accelerated, while fixing those vulnerabilities still requires engineering work. Producing a fix requires understanding the flaw and modifying the code without breaking other functionality.

Self-generated proof, review and regression testing

When the environment allows it, VR-1.1 first writes its own proof of concept to reproduce the reported flaw. It then traces the vulnerability through the affected code, including related paths that exploit the same weakness.

The model makes a targeted modification, such as checking an index before using it. A separate review step examines the fix in a fresh environment. It looks for ways to bypass the fix and checks whether the modification has introduced a new flaw. VR-1.1 also writes regression tests that can signal if the vulnerability returns after a subsequent code change.

If an attempt fails, the model carries the previous diagnosis and details of the error into the next trial. Cogent said the result includes the diagnosis and test results alongside the fix, allowing security teams to verify the change.

The company is building toward autonomous vulnerability management

VR-1.1 builds on the capabilities of VR-1, which Cogent introduced in July. According to the company, the earlier model examined which attack paths an attacker could reach in an enterprise environment and was also able to demonstrate them.

Cogent Security is developing an enterprise platform that uses artificial intelligence agents for autonomous cybersecurity protection. The company said its agents follow the process from vulnerability discovery through validated remediation across cloud, on-premises and endpoint environments. Customers set the policies to follow and can decide which fixes should run automatically and which should wait for approval.

According to the company, Fortune 500 security teams using Cogent reduced the exposure window for critical vulnerabilities by 97%. Cogent Research published the full methodology in a separate report.