San Francisco startup says its AI fixes more real software security holes than Claude Code or Codex
Cogent Security's VR-1.1 repaired 57.9% of test flaws, by the company's own count.
Cogent Security, a San Francisco startup, said Tuesday that its AI system VR-1.1 repaired 57.9% of the real software flaws in a public test, versus 45.3% for both Anthropic's Claude Code and OpenAI's Codex. The results come from Cogent's own testing.
Cogent sells AI software that helps companies' security teams find, rank and fix weak spots in their computer systems. Its co-founders include chief executive Vineet Edupuganti and chief technology officer Geng Sng, who both previously worked at the security company Abnormal AI, according to Cogent's website. The company came out of stealth in July 2025 with $11 million from venture firm Greylock and raised a $42 million Series A, its first big funding round, from Bain Capital Ventures and Greylock in February, according to news coverage listed on its site.
The test, LiveCVEBench, was built by Harbin Institute of Technology and Chinese tech firm Kuaishou. It uses 190 CVEs, publicly listed security holes, and a fix counts only if it closes the hole and the software still works. Each tool got three tries.
Cogent says VR-1.1 first writes a small attack to prove the flaw exists, makes a narrow fix, has a separate check review it and writes tests to catch the bug returning. The company says more than 90,000 CVEs were published this year and the typical one takes 43 days to patch.
How can a small startup beat tools from Anthropic and OpenAI, two of the biggest AI companies? Cogent says the gap comes from focus. It says VR-1.1 was trained specifically on security repair work and built to work the way security engineers do: reproduce the flaw, fix it, then try to break the fix. Claude Code and Codex are broader coding assistants.
Whether the lead lasts is an open question. The results come from a test Cogent ran itself, and the company noted that the tools used different amounts of computing. Cogent also says the flaws in the test were published before the big models' training cutoffs, so those models may have seen some fixes, and that any fixed test goes stale as newer models train past it. It says it is building a new test from more recently disclosed flaws.
Source: Cogent Security blog, Nov. 3, 2026, and Cogent's company and newsroom pages