Cogent lets AI agents carry vulnerabilities through to a fix, with policy outside the model holding the brake

Cogent is combining OpenAI models with its own context system to build agents that carry a vulnerability from discovery to a verified fix. The company says one automotive customer cut mean time to remediate critical vulnerabilities by 75 %, while another enterprise increased vulnerability triage throughput fivefold. Both figures come from Cogent and its customers.

A context graph gives agents a map of the company and permission to act

The Context Engine maintains a graph of assets, vulnerabilities, identities, owners and dependencies. Background agents reconcile data across security tools so a new vulnerability does not require the system to rediscover which asset is affected, who owns it and what a fix could disrupt.

Cogent uses GPT-6.1 Sol for general execution, GPT-5.6 for more routine work and GPT-6 Astra to plan complex interventions. When the critical PHP2Shell flaws were disclosed, the case study says its agents identified affected systems, assessed exposure, prepared fixes around dependencies and then verified the result.

Autonomy depends on authorization, not model obedience

Each customer decides which changes an agent may execute and which require approval. TRACE checks tool calls against those rules deterministically, without another language model decision. A separate gateway verifies authorization again, while higher risk work can run in isolated sandboxes.

That is the more useful pattern for enterprise agents. A model can propose a change, but a system that cannot be persuaded by a prompt should control its authority. Without that separation, faster remediation would also shorten the path from a bad judgment to a production incident.

The results are customer stories rather than an independent audit

A 75 % reduction in mean time to remediate and fivefold throughput are substantial claims, but they are not a controlled benchmark across customers. The published material does not show how complex the affected systems were, how many interventions needed a person or how many agent proposals were rejected.

Cogent also combines several models with its own graph, policies, gateway and integrations. The outcome cannot be credited to GPT-6.1 Sol alone. Value comes from the operating system around it, especially the quality of enterprise data and the precision of permissions.

Rejected actions and rollbacks will decide whether the defense holds

The next useful numbers are the share of fixes completed without a person, rollback frequency, false refusals and incidents caused by an agent. Customers must also be able to audit every step and revoke authority quickly.

Cogent plans to expand autonomous remediation from straightforward configuration changes to multi-step workflows across enterprise systems. As the action chain grows, the speed of the first proposal matters less than the agent's ability to stop safely.

Lilith's verdict

A model may find the weakness and propose a fix, but the guard at the production console must be immune to persuasion by prompt. Cogent is placing the important bet on that guard.