New AI Tools: Cogent VR-1 Proves 2x More Enterprise Attack Paths Than Frontier Models — No Red Team Required

The most consequential new AI tools of this cycle are not chatbots — they are models trained to do one job better than a generalist ever will. This week's clearest example is Cogent VR-1, a frontier reasoning model built specifically for cybersecurity, which claims roughly double the rate of proven enterprise attack paths of the best general-purpose frontier models at about a quarter of the cost.

That framing matters. VR-1 is not a vulnerability scanner with a language model bolted on, and it is not another "AI-native security" badge. It is post-trained to behave like a patient intruder: given one small foothold and an objective, it investigates an unfamiliar environment, forms hypotheses, crosses system boundaries, and then executes the chain to prove the path is real. This guide explains what was announced, what the numbers actually say, where the claims are still unverified, and what a security team should do about it this month — with no red team required to get started.

What Cogent VR-1 Actually Is

Cogent Security announced VR-1 as, in its own words, the first frontier model trained and optimised specifically for cyber work rather than picking up cyber capability as a side effect of general coding and reasoning strength. Three things shipped together:

• VR-1 — the reasoning model itself, post-trained on offensive investigation and attack-path composition.
• IntrusionBench — a new benchmark that scores whether an agent can complete a realistic enterprise attack chain from limited starting access, with an execution-based verifier rather than a multiple-choice grader.
• The Cogent AI Harness — a runtime environment for running cyber agents with scoped tools, containment and logging.

All three are distributed through Cogent's Frontier Access Program rather than a public API, and the company describes both the model and the benchmark as early preview. That last detail is the single most important caveat in this story, and we will come back to it.

Why a specialised cyber model is different

General frontier models are already good at security tasks. They read source code, spot injection flaws, drive standard tooling and reproduce known exploitation techniques. What they are weak at is the part that actually defines an intrusion: composition.

Finding a bug in one codebase is a bounded task. A real enterprise attack travels through cloud infrastructure, identity providers, application runtimes, CI/CD pipelines, internal wikis and human process. Each individual weakness looks like ordinary backlog noise — a slightly over-scoped service account here, an unverified build artifact there. Strung together in the right order, they reach the crown jewels.

VR-1 is trained on that sequencing problem. According to Cogent's engineering write-up, it maps the environment around a foothold, tests which boundaries are actually crossable, executes the resulting chain, and then checks whether a proposed fix closes the gap or merely relocates the risk. That last capability — fix verification — is arguably more useful to defenders than the offensive half, because it answers the question every remediation ticket dodges: did that change actually break the path?

The Benchmark Numbers, Read Carefully

Here is the headline as reported: on IntrusionBench, VR-1 proved roughly twice as many enterprise attack paths as leading frontier models, at approximately a quarter of the cost. Cogent's own research post is more precise: more than a 2x lift in pass@3 over the strongest frontier baseline in its evaluation, on the black-box configuration, under a two-hour wall-clock limit or 250 agent turns — whichever comes first. The comparison set named in the launch materials includes Kimi K3, Claude Opus 4.8 and GLM-5.2.

Four things are worth separating before anyone quotes this figure in a board deck:

1. pass@3 is not a success rate

pass@3 means the agent gets three attempts and counts as successful if any attempt reaches the objective. It is a legitimate metric for autonomous work where retries are cheap, but it is not the same as "succeeds 2x as often on the first try." Treat it as a measure of how reliably the model can find a path when allowed to explore.

2. The benchmark is the vendor's own

IntrusionBench was built by Cogent, released alongside the model that wins it, and the full technical report — task design, environment architecture, grading methodology, baseline configurations — is still pending. Cogent says so openly, and explicitly flags that the published figures come from a small task set and are meant to convey direction rather than final magnitudes. That is unusually honest for a launch, and it also means the 2x number will move.

3. The cost claim is about efficiency, not licence price

"Roughly a quarter of the cost" refers to inference spend per proven path in the evaluation, not to what VR-1 costs a customer. A specialised model can burn far fewer agent turns reaching the same conclusion, which compounds in agentic workloads where every wasted turn is a full-context API call. We saw the same dynamic in our coverage of open math results, where the interesting number was cost per verified result rather than raw capability.

4. "Mythos-class" is a threshold, not an equivalence

Cogent uses "Mythos-class" to describe a capability threshold — the line between models that can find vulnerabilities and models that can develop them into material cyber threats — not general parity with Anthropic's models. If you see the phrase used as "as strong as Anthropic's frontier model," that is a misreading of the vendor's own definition.

Why This Launch Landed Now

The timing is not accidental. The argument for defensive cyber AI stopped being hypothetical over the past year, as autonomous or semi-autonomous intrusion activity moved from research demos into incident reports involving large technology companies and government systems. Cogent's announcement leans on exactly this: once capable models are in adversary hands, the asymmetry is that attackers only need one working chain while defenders must reason about all of them.

That asymmetry is a machine-scale problem. A human red team can afford to explore a handful of hypotheses per engagement. An agent that can run 250 turns against a scoped environment, repeatedly, can explore hundreds — and will surface the ugly cross-system paths that never appear on a vulnerability-scanner report because no single finding in the chain is severe.

It also fits the broader pattern we have tracked all quarter: agentic systems are being narrowed and hardened for specific domains rather than widened. The same shift is visible in embodied control models and in tool-access layers built for agents. Specialisation is where the current performance headroom is.

The Harness Is the Underrated Part

Most coverage focused on the model. For anyone who has to sign off on running an offensive agent inside a production network, the runtime matters more.

Cogent published an ablation showing the same model performing measurably differently with and without its harness — which tells you the scaffolding is doing real work, not just providing safety theatre. The reason is mechanical: agent performance on long-horizon tasks depends heavily on how tools are exposed, how state is carried between turns, and how failure is fed back into the next hypothesis.

The security requirements are equally mechanical, and they map cleanly onto the OWASP Top 10 for LLM applications: least-privilege tool scoping, hard blast-radius limits, immutable logging of every action for post-hoc review, and a kill switch that does not depend on the agent cooperating. Any vendor selling you an offensive agent without all four is selling you an unbounded liability. This is the same guardrail checklist we applied to agentic automation in ordinary business workflows — the stakes are simply higher when the tool's purpose is to succeed at intrusion.

What Defenders Should Actually Do This Month

You almost certainly cannot buy VR-1 today; access is gated. That does not make the news academic, because the capability it demonstrates changes what your program should be optimising for regardless of vendor.

1. Move from findings to paths

If your security reporting is a list of severity-ranked findings, you are measuring the wrong unit. Start asking which sequences of findings connect an internet-facing asset to something that would end your quarter. Attack-path thinking is free to adopt and immediately changes prioritisation: a medium plus a low plus a misconfiguration frequently outranks an isolated critical.

2. Audit identity before anything else

In nearly every published cross-system chain, the pivot is an identity carrying more permission than its task requires — a CI service account with production write access, a stale role trust, an over-broad OAuth grant. Machine identities now vastly outnumber human ones in most environments and are audited far less. This is the highest-yield week of work available to most teams.

3. Treat your build pipeline as production

Artifacts trusted without verification are the quiet third link in most chains. Signed builds, provenance attestation and pinned dependencies are unfashionable and effective. If you want a framework rather than a vibe, the NIST Cybersecurity Framework maps this cleanly under Protect and Detect.

4. Demand verified fixes, not closed tickets

The most transferable idea in the VR-1 release is fix verification: re-running the path after remediation to confirm it is closed rather than displaced. You can implement a manual version of this immediately by requiring that any high-priority remediation ticket includes evidence the original path no longer executes.

5. Write your AI-agent policy now

Whether the agent is offensive, defensive or a coding assistant with repository write access, the governance questions are identical: what can it touch, who approved that scope, where are the logs, and who is accountable for the output. Organisations operating in Europe should also note that security tooling with autonomous action falls squarely into the risk-management expectations of the EU AI Act. Our AI for business hub tracks how these obligations are landing in practice.

The Dual-Use Question Nobody Can Wave Away

A model post-trained to compose and execute enterprise attack chains is, by construction, an offensive capability. Cogent's position is the standard and largely defensible one: defenders need models that find the paths an attacking model would find, and gated access plus a controlled harness is how you get that without arming everyone.

The honest counterpoint is that gating is a delay, not a barrier. Specialised post-training recipes diffuse — through papers, through staff mobility, through open-weight base models that get fine-tuned by people with different intentions. The realistic planning assumption is that within a year or two, attack-path composition at roughly this level is available to motivated adversaries without a Frontier Access Program invitation.

Which means the defensive value of this release is not the model you might eventually license. It is the advance notice: the class of weakness that is about to get systematically hunted is the boring cross-system chain, and you have a window to close yours first.

Verification Notes

The claims above are drawn from Cogent's product announcement and its more technical build-and-benchmark write-up, the company's press release, and independent coverage from MarkTechPost. IntrusionBench's methodology is not yet public; every performance figure here is vendor-reported and preliminary by Cogent's own statement. We have flagged each unverified claim inline rather than laundering it into fact.

The Bottom Line

Cogent VR-1 is the strongest evidence so far that domain-specialised frontier models beat generalists on hard, long-horizon professional work — and cybersecurity, where the task is composing a chain rather than answering a question, is close to the ideal test case. A 2x lift in proven attack paths at a quarter of the inference cost is a big claim on a preview benchmark the vendor wrote, so hold it loosely until IntrusionBench is public and someone else runs it.

The part you can act on today needs no vendor at all: stop counting findings, start tracing paths, fix your machine identities, verify your remediations, and write the policy governing what your agents are allowed to touch. Follow the next moves in our generative AI news and AI tool reviews hubs, and read our complete guide to evaluating AI tools before you sign anything.