网络安全
在LiveCVE Bench任务中57.9%的通过修复
在 Google 上的首选来源中添加 Unite.AI
Cogent Security 推出 VR-1.1, 2026年11月3日报道，脆弱性修复模型对LiveCVE Bench的190项任务中57.9%进行了过路维修，而Claude Code和Codex各为45.3%.
对Cogent的VR家族的最新添加用VR-1扩展了推出的补救能力。 其评价将VR-1.1与运行Claude Opus 5.5的Claude Code和运行GPT-5.6-Cyber的Codex进行比较。 每个系统收到相同的输入和设置，每个任务三次尝试，内部修复尝试后根据最终补丁得分。
围绕工作修理建造的基准测试
LiveCVE Bench侧重于在发展环境中确定现实世界的脆弱性。 它的CVE-Factory论文描述了一套不断更新的190项任务，涵盖14种编程语言和153个寄存器。 基准测试项目将agents置于真正的发展环境中，它们必须自主探索代码库，确定每一种脆弱性的背景，并实施固定。 定期增加新的简历。
Cogent的设置为每项任务提供了一份脆弱性报告和受影响的代码库。 只有当脆弱性检查通过，功能检查继续通过时才算出补丁。 任务包括注射，访问控制，配置和内存安全缺陷，因此如果改变留下另一路径到缺陷，使合法行为失效，导致回归或推出新曝光，那么一个令人信服的解释是不够的。
这一双重要求将修复与仅仅阻止一次攻击示威区分开来。 模型在关闭弱点的同时必须保持预期行为，包括分享弱点的相关路径。
VR-1.1的修理流程
Cogent将其结果归结为安全修复训练以及复制一个弱点的绳索，将其补丁，然后测试补丁以进行绕行。 在运行配置允许的情况下，VR-1.1在写出引发缺陷的概念证明之前，先检查报告和源代码。 这使得模型无法追踪，在补丁后进行重新运行的测试。
该模型在进行重点修改之前，先寻找共享弱点的相关代码路径。 在新上下文中单独检讨对绕行和推出bug的补丁。 VR-1.1还写了回归测试。 当验证失败时，其早先的分析和关于故障的信息指导了另一次尝试。
实践纤维修理
有记录的一次运行涉及Fiber网络框架中的CVE-2025-48075. 该项目的安全咨询称嵌入式数据中的负索引会令其BodyParser恐慌并崩溃服务器，从而产生拒绝服务的风险。 它将2.52.6的版本列为受影响版本，将2.52.7列为补丁发布版本。
VR-1.1复制了崩溃，并在使用索引前添加了边框检查，拒绝负或过量的指数，同时保留有效的形式处理。 Cogent报告说，所有9次脆弱性检查都是事后通过，而前为零，而所有12次功能检查都是前后通过。 这个例子来自单独记录的182任务运行，而不是最终的190任务评估。
评价限制和生产使用
评估在修复期间阻止了网络外出访问，并暂停了LiveCVE Bench的分级测试，直到每个agent完成。 这些条件妨碍了上游固定设备的检索，也妨碍了在补丁时直接使用分级测试。
Cogent警告说，两个基准模型的培训截止日期都比当前LiveCVE Bench版的CVE的出版日期要晚，这意味着其咨询意见和修正本可以在培训数据中出现。 它将用户报告式的任务说明、被封锁的联网和相同的条件确定为这一优势的限制。
在Cogent的抽查中，模型可以描述一些来自记忆的弱点，但没有复制精确的补丁。 公司还正在根据CVES公司在相关截断后披露的任务进行构建，并计划保持其及时性。
LiveCVE Bench测试在孤立环境中已知的脆弱性，通过意味着满足所提供的检查。 Cogent 称生产部署仍需在目的地环境中进行审查和测试。 它正在将VR-1.1纳入其补救工作流程，每个补丁都附有其诊断、概念证明和供审查人员检查的测试。 因此，基准测试结果在受控制的条件下对检查的修理采取了措施；生产用途仍然取决于对软件运行地点的修理进行验证。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Cogent Reports VR-1.1 Passing Repairs on 57.9% of LiveCVEBench Tasks
Add Unite.AI to your preferred sources on Google
Cogent Security introduced VR-1.1 on November 3, 2026, reporting that the vulnerability-repair model produced passing repairs for 57.9% of LiveCVEBench’s 190 tasks, compared with 45.3% each for Claude Code and Codex.
The latest addition to Cogent’s VR family extends the remediation capabilities introduced with VR-1. Its evaluation compared VR-1.1 with Claude Code running Claude Opus 5.5 and Codex running GPT-5.6-Cyber. Each system received the same inputs and setup and three attempts per task, with scores based on the final patch after its internal repair attempts.
A Benchmark Built Around Working Repairs
LiveCVEBench focuses on fixing real-world vulnerabilities in development environments. Its CVE-Factory paper describes a continuously updated set of 190 tasks spanning 14 programming languages and 153 repositories. The benchmark project places agents in real development environments where they must explore codebases autonomously, establish the context of each vulnerability and implement a fix. New CVEs are added regularly.
Cogent’s setup supplied a vulnerability report and affected codebase for each task. A patch counted only when vulnerability checks passed and functionality checks continued to pass. The tasks cover injection, access-control, configuration and memory-safety flaws, so a convincing explanation is insufficient if the change leaves another route to the flaw, disables legitimate behavior, causes a regression or introduces new exposure.
That dual requirement distinguishes a repair from merely stopping one demonstration of an attack. A model must preserve intended behavior while closing the weakness, including related paths that share it.
VR-1.1’S Repair Workflow
Cogent attributes its result to security-repair training and a harness that reproduces a weakness, patches it and then tests the patch for bypasses. Where the run configuration permits, VR-1.1 inspects the report and source code before writing a proof of concept that triggers the flaw. That gives the model a failure to trace and a test to rerun after patching.
The model looks for related code paths sharing the weakness before making a focused change. A separate review in a fresh context examines the patch for bypasses and introduced bugs. VR-1.1 also writes regression tests. When validation fails, its earlier analysis and information about the failure guide another attempt.
A Fiber Repair in Practice
One recorded run involved CVE-2025-48075 in the Fiber web framework. The project’s security advisory says a negative index in nested form data can panic its BodyParser and crash a server, creating a denial-of-service risk. It lists versions from 2.52.6 as affected and 2.52.7 as the patched release.
VR-1.1 reproduced the crash and added a bounds check before the index was used, rejecting negative or excessive indices while preserving valid form handling. Cogent reports that all nine vulnerability checks passed afterward, versus zero before, while all 12 functionality checks passed both before and after. The example came from a separate recorded 182-task run, not the final 190-task evaluation.
Evaluation Limits and Production Use
The evaluation blocked outbound network access during repair and withheld LiveCVEBench’s grading tests until each agent finished. Those conditions prevented retrieval of an upstream fix or direct use of the grading tests while patching.
Cogent cautions that both baseline models have training cutoffs later than the publication dates of the CVEs in the current LiveCVEBench release, meaning their advisories and fixes could have appeared in training data. It identifies the user-report-style task descriptions, blocked networking and identical conditions as limits on that advantage.
In Cogent’s spot checks, models could describe some vulnerabilities from memory but did not reproduce exact patches. The company is also building a task set from CVEs disclosed after the relevant cutoffs and plans to keep it current.
LiveCVEBench tests known vulnerabilities in isolated environments, and passing means satisfying the supplied checks. Cogent says production deployment still requires review and testing in the destination environment. It is bringing VR-1.1 into its remediation workflow, with each patch accompanied by its diagnosis, proof of concept and tests for reviewer inspection. The benchmark result therefore measures checked repairs under controlled conditions; production use still depends on validating those repairs where the software will run.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.