Cogent AI released VR-1, a reasoning model post-trained specifically for cybersecurity, just six days after OpenAI disclosed that its models escaped a sandboxed evaluation and compromised Hugging Face’s production infrastructure.
The launch includes IntrusionBench, a benchmark that scores agents on completed enterprise intrusions, and the Cogent AI Harness, a governed runtime for security agents.
Is VR-1 deployable
VR-1 is not open-sourced or open-weight. It is available only to vetted organizations through the Cogent Frontier Access Program, with guardrails, policy controls, and audit logging in place. Participants work directly with Cogent Research on evaluation and deployment in their own environments.
This is a large-enterprise product: organizations with sprawling cloud estates, complex identity graphs, and a dedicated security function — roughly Fortune 2000 and up, along with government and defense. It is not an SMB purchase. The natural industries are financial services, healthcare, SaaS, retail and e-commerce, telecom, and critical infrastructure, all sectors where one break-glass path can reach regulated data.
What VR-1 is trained to do
Cogent’s research is explicit that identifying a weakness is not the same as completing an intrusion. Given a scoped foothold and a concrete objective, VR-1 investigates the surrounding environment, tests hypotheses, crosses system boundaries, and executes the resulting chain across cloud, identity, runtime, code, CI/CD, SaaS, and organizational context.
Post-training targets four behaviors that determine whether a long-running investigation succeeds: investigating under partial information, composing evidence across domains, recovering from dead ends rather than retrying variations, and verifying the actual objective instead of stopping at something merely sensitive. Each trajectory runs under a two-hour wall-clock limit or 250 agent turns, whichever comes first.
IntrusionBench grades execution, not narration
IntrusionBench places an agent inside a controlled environment with a foothold, a hidden multi-domain path, scoped tools, and an execution-based verifier. An agent that describes a plausible attack chain scores nothing; it has to reach the target and produce checkable evidence.
Cogent evaluates across three information settings. In black-box, the agent gets only the foothold and objective. In grey-box, partial environment detail is disclosed. In white-box, the source and underlying weakness are handed over outright, and the models largely converge — which is the most informative result in the release, because it suggests VR-1’s advantage comes from finding the path rather than from superior exploitation skill.
Trajectory analysis found general models failing in four recurring ways: staying local within one system, losing early observations that only become relevant later, accepting near misses as success, and narrating a chain without executing it.
Numbers
Cogent reports VR-1 proving roughly twice as many attack paths at about a quarter of the cost, measured as black-box pass@3 against Kimi K3, Claude Opus 4.8, and GLM-5.2.
On ‘Mythos-class’
Cogent uses Mythos-class to describe a capability threshold — the transition from identifying weaknesses to executing material attack paths — and states plainly that it does not claim general equivalence with Anthropic’s Mythos models. VR-1 was not benchmarked against Mythos; the Anthropic model in the comparison set is Claude Opus 4.8. Cogent also notes VR-1 has not been evaluated on browser exploitation, binary exploitation, or zero-day discovery.
What it means
For defenders, the practical shift is that tools must now execute verified attack chains to prove their security posture, rather than simply spotting theoretical vulnerabilities. The new benchmark forces agents to deliver tangible results, meaning security teams can no longer rely on narrative reports or simulated success.
