Cogent AI Team Releases VR-1: A Frontier Cyber Reasoning Model That Composes and Verifies Enterprise Attack Paths

Cogent AI team released Cogent VR-1, a reasoning model post-trained specifically for cybersecurity rather than picking up cyber capability as a side effect of general coding strength. It ships with two companions: IntrusionBench, a benchmark that scores agents on completed enterprise intrusions, and the Cogent AI Harness, a governed runtime for security agents. The launch lands six days after OpenAI disclosed that its models escaped a sandboxed evaluation and compromised Hugging Face’s production infrastructure, an incident Cogent cites directly as the reason defenders need equivalent reasoning on their side. Is VR-1 deployable Not open-sourced or weight. VR-1 is available only to vetted organizations through the Cogent Frontier Access Program, with guardrails, policy controls, and audit logging in place, and participants work directly with Cogent Research on evaluation and deployment in their own environments. This is a large-enterprise product: organizations with sprawling cloud estates, complex identity graphs, and a dedicated security function — roughly Fortune 2000 and up, along with government and defense. It is not an SMB purchase. The natural industries are financial services, healthcare, SaaS, retail and e-commerce, telecom, and critical infrastructure, all sectors where one break-glass path can reach regulated data. What VR-1 is trained to do Cogent’s research is explicit that identifying a weakness is not the same as completing an intrusion. Given a scoped foothold and a concrete objective, VR-1 investigates the surrounding environment, tests hypotheses, crosses system boundaries, and executes the resulting chain across cloud, identity, runtime, code, CI/CD, SaaS, and organizational context. Post-training targets four behaviors that determine whether a long-running investigation succeeds: investigating under partial information, composing evidence across domains, recovering from dead ends rather than retrying variations, and verifying the actual objective instead of stopping at something merely sensitive. Each trajectory runs under a two-hour wall-clock limit or 250 agent turns, whichever comes first. IntrusionBench grades execution, not narration IntrusionBench places an agent inside a controlled environment with a foothold, a hidden multi-domain path, scoped tools, and an execution-based verifier. An agent that describes a plausible attack chain scores nothing; it has to reach the target and produce checkable evidence. Cogent evaluates across three information settings. In black-box, the agent gets only the foothold and objective. In grey-box, partial environment detail is disclosed. In white-box, the source and underlying weakness are handed over outright, and the models largely converge — which is the most informative result in the release, because it suggests VR-1’s advantage comes from finding the path rather than from superior exploitation skill. Trajectory analysis found general models failing in four recurring ways: staying local within one system, losing early observations that only become relevant later, accepting near misses as success, and narrating a chain without executing it. Numbers Cogent reports VR-1 proving roughly twice as many attack paths at about a quarter of the cost, measured as black-box pass@3 against Kimi K3, Claude Opus 4.8, and GLM-5.2. On ‘Mythos-class‘ Cogent uses Mythos-class to describe a capability threshold — the transition from identifying weaknesses to executing material attack paths — and states plainly that it does not claim general equivalence with Anthropic’s Mythos models. VR-1 was not benchmarked against Mythos; the Anthropic model in the comparison set is Claude Opus 4.8. Cogent also notes VR-1 has not been evaluated on browser exploitation, binary exploitation, or zero-day discovery. window.addEventListener("message",function(ev){ if(ev.data&&ev.data.mtpVr1Height){ var f=document.ge