Cogent, a cybersecurity AI startup, released VR-1, a model trained to carry out full intrusion chains rather than flag a single vulnerability. The system takes a narrow foothold and a goal, then investigates on its own, crossing between cloud infrastructure, application code, and internal documentation to complete the attack itself. That shifts the product from a scanner that flags weak points to an agent that exploits them end to end.
Cogent tested VR-1 on IntrusionBench, a benchmark it also built. On the hardest of three test settings, black-box, where the model gets only a foothold and a target to reach, VR-1 posted more than double the pass rate of the strongest rival Cogent evaluated. The metric was pass@3: three independent attempts per task, credited if any one of them succeeds within a two-hour limit or 250 agent actions.
That figure deserves a discount before it travels any further. Cogent designed the model, wrote the benchmark, chose the comparison models, and published the result without an outside lab replicating any of it. A company grading its own product on a test it also authored will tend to produce a flattering number, since the task selection, scoring rules, and difficulty curve all sit with the same team that has a product to sell. Cogent says as much itself, describing both VR-1 and IntrusionBench as “early preview” and calling the figures “preliminary,” drawn from a small set of tasks meant to show direction rather than a settled magnitude. Until an independent group runs the same tasks against the same rivals, the 2x claim is best read as a marketing number with a methodology attached, not a verified capability gap.
More telling than the headline figure is how Cogent says the gap behaves. When models are given partial information about the target environment, VR-1’s lead shrinks. When the underlying weakness is disclosed outright, general-purpose frontier models close most of the distance. Cogent attributes VR-1’s edge to persistence rather than raw exploit knowledge: staying on task after a permission check fails, recovering an unrelated finding from earlier in a run, and confirming that whatever it reached is the actual target before declaring the job done.
Cogent frames VR-1 as approaching the same qualitative jump it says Anthropic’s Mythos models made, from spotting a flaw to producing a working exploit. The company is careful to bound that comparison, saying VR-1 has not been tested against Mythos on browser or binary exploitation, only on this style of enterprise, cross-system chaining.
This is offensive capability sold as a product, and Cogent markets it as one. The buyer for a tool like this is red teams and penetration testers who want an agent that can run a complete attack path with less manual scaffolding. The same capability, once packaged into a harness and shipped, does not stay confined to authorized testers by design; it stays confined by whoever controls access to the weights and tooling.
For defenders, the more useful part of Cogent’s post is not the win rate but the described failure modes. Cogent says weaker agents tend to get stuck exploring one system instead of switching domains, lose track of a permission discovered earlier in a run, mistake a near miss for the objective, or describe an attack plan without executing it. Those are the exact gaps an agentic attacker is being built to close first. Security teams should audit whether their own defenses depend on an attacker never reconnecting a stray finding from an earlier step, because that assumption is the one this category of tool is designed to break.
Cogent detailed VR-1’s design, benchmark methodology, and preliminary results in a company blog post published July 27, 2026.
