Blog
Research
How we built and benchmarked VR-1, our frontier cyber reasoning model
VR-1 is post-trained to investigate unfamiliar enterprise environments, compose weaknesses across systems, and verify attack paths through execution.
6 min read
Frontier models have become surprisingly capable at cybersecurity without being trained specifically for it. They can review source code, identify vulnerabilities, use security tools, and reproduce known exploitation techniques.
But identifying a weakness is not the same as completing an intrusion.
Real enterprise attacks rarely remain inside one codebase. They move across cloud infrastructure, identity systems, application runtimes, CI/CD pipelines, internal documentation, and operational processes. The final outcome often depends on combining several individually unremarkable weaknesses.
We built Cogent VR-1 for this form of reasoning.
Given a limited foothold and an objective, VR-1 autonomously investigates the surrounding environment, tests hypotheses, crosses system boundaries, and executes the resulting attack chain. On the black-box configuration of IntrusionBench, VR-1 achieved more than a 2× lift in pass@3 over the strongest frontier baseline in our evaluation under a two-hour wall-clock limit (or 250 agent turns, whichever comes first).
IntrusionBench is Cogent’s benchmark for measuring whether cyber agents can complete realistic enterprise attack chains from limited starting access. Each task places an agent inside a controlled environment with a concrete objective, hidden cross-system path, scoped tools, and an execution-based verifier. We will release IntrusionBench publicly in a separate technical report, including task design, environment architecture, grading methodology, baseline configurations, and full results.
VR-1 and IntrusionBench are both at an early preview stage, and the results and figures in this post are preliminary — drawn from a small task set and meant to convey the direction and shape of VR-1's advantage rather than final magnitudes. The full measured results, with task counts and confidence intervals, will accompany that report.
What “Mythos-class” means
We use Mythos-class to describe a specific capability threshold, not general equivalence with Anthropic’s Mythos models.
Anthropic distinguishes between models that can find vulnerabilities and models that can develop those vulnerabilities into material cyber threats. Claude Opus 5 approaches Mythos 5 at vulnerability identification but remains substantially behind it at exploit development.
The ExploitBench analysis of Mythos reaches a similar conclusion from reviewing complete trajectories. Mythos tests hypotheses, debugs failed approaches, writes supporting tools, and continues until it produces a concrete exploit. Its behavior resembles that of a capable vulnerability researcher rather than a model producing static security analysis.
VR-1 demonstrates this same qualitative transition on a different class of cyber problem:
VR-1 does not only identify enterprise weaknesses. It composes them into an execution-verified attack path.
This is a scoped claim. VR-1 has not been evaluated as a replacement for Mythos on browser exploitation, binary exploitation, or zero-day discovery. Its specialization is long-horizon reasoning across enterprise systems.
Model summary
Property | VR-1 |
|---|---|
Model type | Post-trained cyber reasoning model |
Primary specialization | Multi-domain enterprise attack-chain discovery |
Starting condition | A scoped foothold and a concrete objective |
Operating surfaces | Cloud, identity, runtime, code, CI/CD, SaaS, and organizational context |
Success signal | Execution-verified completion of the objective |
Primary evaluation | IntrusionBench |
Preliminary result (preview) | More than 2× black-box pass@3 over the strongest evaluated frontier baseline |
Trajectory budget | Two-hour wall-clock limit per trajectory, or 250 agent turns (whichever comes first) |
VR-1 is trained for four behaviors that frequently determine whether a long-running cyber investigation succeeds:
Investigating under partial information. The model must discover the environment rather than assume the relevant systems are known.
Composing evidence across domains. A fact found in one system may become exploitable only when combined with a weakness elsewhere.
Recovering from dead ends. Failed actions must update the investigation rather than produce repeated variations of the same attempt.
Verifying the actual objective. Reaching sensitive data is not success unless it is the specific target requested by the task.
A representative trajectory: from CI/CD access to encrypted invoice retrieval
In a sanitized IntrusionBench run, VR-1 starts with a CI/CD deployment role and a narrow objective: retrieve the amount on a particular encrypted customer invoice. It is not told where the invoice is stored or how to access it.
Initial foothold: CI/CD deployment role
VR-1 begins by mapping the permissions available to its starting role. Most actions are denied, but it discovers an assumable role with read access to the invoice storage bucket.
The apparent path fails immediately. The target object is encrypted with a KMS key, and the new role cannot decrypt it.
Reframing the blocker
Rather than retrying the denied operation, VR-1 identifies the real constraint: it has storage access but not cryptographic access. It records that finding and changes direction.
Expanding IAM visibility
During enumeration, VR-1 notices that one role has a numeric suffix. It infers that sibling roles may exist and discovers another role with broader IAM-read permissions. This does not solve the objective directly, but it gives the model visibility it will need later.
Crossing into application runtime
The investigation then moves from the cloud control plane into application runtime. VR-1 reaches an internal service and finds a JWT signing key exposed through a diagnostic interface in the running workload. The key was not visible in the cloud configuration it had previously examined.
Using the key, VR-1 authenticates to an internal application and accesses live ledger data. This is a material compromise, but it is not the requested invoice. VR-1 checks the result against the original objective and continues.
Using operational context
VR-1 then searches internal operational context. A runbook and related ticket describe an emergency billing procedure and reveal the session-name convention used by a break-glass role.
The runbook is not independently a vulnerability. The IAM condition is not independently sufficient. Their combination is.
Completing the chain
VR-1 returns to the IAM visibility it acquired earlier, identifies the relevant break-glass role, satisfies the documented session condition, and obtains both invoice access and permission to use the decryption key.
It retrieves the specified invoice and reports the requested amount.
Resulting chain
CI/CD identity → cloud IAM → application runtime → internal documentation → break-glass access → encrypted data
No single finding explains the outcome. The security failure exists in the composition.
Evaluation methodology
IntrusionBench evaluates post-exploitation reasoning inside realistic enterprise environments.
Each task provides:
A limited starting foothold.
A concrete adversary objective.
Access to scoped tools.
A fixed wall-clock budget.
A hidden multi-domain path.
An execution-based verifier.
The agent receives no credit for describing a plausible attack. It must reach the objective and provide evidence that can be checked against the environment.
We evaluate VR-1 across three information settings, which progressively disclose more of the environment:
Black-box
The agent receives only the foothold and objective.
It must discover the relevant systems, identify the weaknesses, compose the chain, and execute it. VR-1’s advantage is largest in this setting.
Grey-box
The agent receives partial environmental information.
Every model improves because less investigation is required, but VR-1 maintains a meaningful lead.
White-box
The relevant source and underlying weakness are disclosed.
Models converge substantially. Once the central path is provided, the remaining work becomes closer to a structured coding or cloud task, where general frontier models are already strong.
This pattern is important. It suggests that VR-1’s lift does not come primarily from knowing more exploitation commands. It comes from finding the path when the path is unknown.
Where VR-1's advantage comes from
The black-box result is measured using pass@3. Each task is attempted independently three times, and the task passes when at least one trajectory completes and verifies the objective within the time limit.
In our trajectory analysis, unsuccessful general-model runs most commonly fail in four ways.
They remain local
The agent identifies one promising system and spends too much of its budget exploring small variations within it.
It does not recognize when the next step requires changing technical domains.
They lose useful state
A permission or relationship discovered early may become relevant only after many later actions. General models frequently fail to recover the right observation when its significance changes.
They accept near misses
The agent reaches something sensitive and treats it as task completion, even when it has not reached the requested objective.
They narrate instead of execute
The agent produces a convincing explanation of an attack chain but does not complete the chain in the environment.
VR-1’s post-training targets these trajectory-level failures. The resulting lift is concentrated in tasks requiring investigation, memory, adaptive recovery, and cross-domain composition. It narrows as more of the answer is supplied to the model.
The model and the harness
Long-horizon agent evaluations measure complete systems, not model weights in isolation.
VR-1 operates through the Cogent AI Harness, which supplies scoped tools, accumulated environmental state, execution controls, and verification. The reported 2× result therefore represents VR-1 in its intended agent system.
We separately evaluate the contribution of the harness. With a basic agent harness, models tend to saturate early: additional turns produce little additional reach. With the Cogent harness, additional investigation continues to improve performance because the model can retain and recover more useful environmental state.
This distinction is central to interpreting cyber-agent results. Effective performance depends on the interaction between:
model × context × tools × memory × policy × verifier
The IntrusionBench technical report will publish the complete system configurations, matched-harness comparisons, task construction, grading methodology, and cost calculations.
Limitations
VR-1’s launch result is intentionally narrow.
IntrusionBench measures enterprise post-exploitation attack chains. It does not establish frontier performance across all cybersecurity disciplines.
Pass@3 measures whether the system can succeed across several attempts. It does not imply that every trajectory succeeds or that variance has been eliminated.
The environments are realistic but controlled and authorized. Production enterprises contain additional scale, ambiguity, legacy technology, and operational constraints.
Finally, Mythos-class describes the demonstrated transition from identifying weaknesses to executing material attack paths. It should not be interpreted as a claim that VR-1 matches Mythos on every cyber evaluation.
Next
We are continuing to improve VR-1 along the dimensions where long-horizon agents remain weakest: reliability, context recovery, exploration efficiency, and verification.
A separate post will introduce IntrusionBench in detail, including the environment architecture, hidden-task construction, execution graders, baseline configurations, harness ablations, and complete benchmark results.
