Rubrik is one of a handful of companies with access to Anthropic’s Claude Mythos, an AI model so good at finding software flaws that it has not been released to the public. At its partner summit in Goa, the company brought Code Guardian, which uses Mythos to test customers’ code the way an attacker would, to enterprises through partners including TCS, Wipro, HCLTech and Deloitte.
On the sidelines, Chief Product Officer Anneka Gupta spoke about what Mythos found in Rubrik’s own code, how the company keeps the model under control, and why she expects a rough 18 months for cybersecurity. Edited excerpts:
Rubrik was part of Project Glasswing. Did Mythos find vulnerabilities in Rubrik’s own code?
Oh, yes. Many. Not all vulnerabilities are the same. Every organisation in the world has software with thousands of vulnerabilities that it hasn’t fixed, because if there’s no way for someone on the outside to exploit a vulnerability, because it sits so deep in your system, it’s not the highest priority. The highest priority ones are those that are exploitable from the outside.
What Mythos has done is find ways to chain different vulnerabilities together, so that there is a path from the outside. I talked to our internal security teams, and they said that once you see it, you can’t unsee it. These are real vulnerabilities, and they’re not that complicated. But we would never have been able to discover the path that makes this set of vulnerabilities exploitable. It would have taken hundreds or thousands of hours. That’s the magic behind what Mythos does. Something that used to be a low priority becomes a high priority, and now you need to go and patch all five vulnerabilities that together led to an exploitable one.
So none of these had existing CVEs?
Right. Anything that had a CVE, we would have already patched, because a CVE comes after the fact. Someone has already discovered it. These were things we found, and every organisation will have the same thing.
The reason there’s so much urgency around this right now is that if you believe open-weight models are going to get to a similar level as Mythos, attackers will be able to discover these vulnerabilities too. That’s really scary. Before, it would have taken them too much time. Now that time is so short that they can actually exploit them.
How many vulnerabilities did Rubrik find?
We published a blog post this week with a number of those figures, and there are ongoing runs finding more. I think the bigger challenge the industry faces is that many organisations have very long patching cycles. They might patch once every six months or once a year. Every organisation is going to have to install the latest updates and patches much more frequently, not only for the code they create but for all the vendors they use. You cannot wait for Patch Tuesday anymore.
If you look at a typical financial services company, they spend three months planning when they’re going to do their patches, and then another two months doing them. That’s the best-case scenario. So it’s not just the technology. A huge amount of process change has to happen for people to move to a more real-time mode of patching, which is absolutely going to be necessary. Attackers are very monetarily motivated.
Has Code Guardian found vulnerabilities in client code during the preview?
We haven’t run it on any client code yet. We’re still doing internal testing and recruiting early customers. As part of Project Hourglass, we’re inviting our partners to bring early customers to try out the product. The product itself is not generally available. What we’re announcing is that we are partnering through Project Hourglass to create an end-to-end solution with the partners.
We have run it on our own internal code, as part of Project Glasswing. We created a lot of findings from that, and we’re patching those. Now we’re taking those learnings and applying them to a system that can do this on client code.
Frontier models have broken free of their guardrails during testing. How do you make Mythos safe to use?
A lot of the issues at the frontier labs have emerged when they’ve been training the models. They have the models try impossible tasks, and the models break free, perhaps because there weren’t sufficient guardrails. They’re improving that. It’s a lot safer to use the models when they’re not in training mode, because everything is directed by the prompts and the responses you get back, and they’re not running fully autonomously. There are a lot of checks and balances.
Anthropic has been very helpful in helping us design the safeguards around the sandbox where we make the model calls. We’re not hosting the model. We’re making calls to the APIs, but even then we’re making sure it’s really locked down.
What guardrails does the Code Guardian harness have?
We do some pre-filtering on the code before it goes to the model, to sanitise it and understand what’s being sent. There’s also post-filtering on the response. We are not going to store and give the raw results from the model back to the customer. We post-process those results, make them more understandable, and take out a lot of the reasoning the model gives, because the other thing people worry about is distillation of the models. So there are a lot of guardrails around the output itself and what we show to the customer.
We’re also not giving the model one very long prompt to run against the code. We’re creating workflows. Some steps in those workflows are deterministic, and some call the model. So it’s not one long-running process. We’re inserting a lot of steps, and a human in the loop.
So clients don’t get access to the model itself. What do they get?
We call Mythos 5 and give the output back to the customer, almost like a PDF report. We’ll build a dashboard as well. But think of it as a report that says: you have 100 P0 findings, here is more information about each one, here’s what makes it exploitable for you, and here are the steps you could take to remediate it, without actually writing the code fix. That’s what we’re planning to begin with. We want to be really thoughtful about what we give the model, what comes back, and what we give the customer.
What role do the Project Hourglass partners play? Do they get access to Mythos?
The partners don’t get access to the raw technology itself. We give them the sanitised findings. If you look at a typical organisation, even if it gets all these findings, actually doing the work to remediate and fix everything is a lot of work. They need extra help. They don’t have the people, and they don’t always have the expertise. That’s where the partners come in. They can do an assessment upfront: which part of your footprint should we start on, and how do we create a plan? If you try to do everything at once, it’s too much. Then they can help with the actual remediation once we’ve provided the report.
How do you ensure a consultant using Code Guardian doesn’t go beyond the guardrails?
They don’t have access to any of our underlying technology. They have the same access a customer would have. They’re not in our code, and they’re not developing code with us. They’re providing services. And we still have a relationship with the end customer, for now. If we decided to go more mid-market, where we might not have that relationship, we would have to rethink the model and how we protect it.
Who approves the end customers?
We have to approve them. The responsibility lies with us, and some of it with Anthropic. Anthropic doesn’t approve the end customers directly, but it has given us guidelines on the types of customers, and we’ll work with the consultants on that.
If Code Guardian finds a vulnerability in a client’s code, who reports it?
We have a sandbox environment, and we create an environment for each customer, so we know who the end customer is. We work with the consultants to decide which part of the code and which repositories to run, and gather all the information. We get the results out, and the consultants share them back with the customer.
It’s still an early product, and it’s a different space from what people have historically been in. We know what worked on our own codebase. We don’t know exactly how it will work for another customer, which is why we have to develop it with actual customers.
Is there a limit on which consultants get access?
Anyone who is part of Project Hourglass. We’ve been very selective about Project Hourglass and work with very strategic partners. We are hand-selecting and inviting partners to join, based on quality rather than quantity. We might open it up more broadly over time, but right now it’s a very early product that still requires a lot of hand-holding.
Do you have a commercial arrangement with Anthropic?
Yes. We’re a customer of Anthropic. We use their models internally and in some of our products outside of Code Guardian. Rubrik AI, the AI agent that sits within our core product, is powered by Anthropic. We’re also selling Code Guardian through the marketplace Anthropic has just developed, where customers can transact. That isn’t exclusive of partners. Just as when we transact through the cloud marketplaces, there can still be a partner involved.
Access to Mythos was suspended in June. If that happens again, what happens to Code Guardian?
We’re working on a multi-model solution. We want a product that works with whatever models are needed. We decided to start with Mythos and expand from there. At the end of the day, we want to bring the best product to market, and different customers will likely want to use different models based on cost and other factors. Different parts of the workflow might also use different models. We do some additional analysis on the repositories to understand how to break them into chunks, and we don’t need Mythos for that initial analysis, only for the hardest pieces. Anybody developing these solutions is going to end up multi-model, because it’s not one action. It’s a whole workflow.
My approach to developing any of our AI products, whether it’s Agent Cloud, Code Guardian or Rubrik AI, is that we have to be flexible. Things are changing so fast. We have to build for flexibility, iterate quickly, and be clear about what the customer needs and what they’re trying to solve.
Are you working with OpenAI?
Today we don’t have a commercial relationship with OpenAI, but we’re exploring it. For our own internal AI usage, we started with Anthropic and chose not to go multi-model at first, because that adds so much complexity and we were focused on adoption. Now we’re asking which model is best for each job. Don’t just use Opus 5 or Opus 5.5 for everything. We’re looking at the cost, performance and latency trade-offs of every model, from Anthropic and others, to understand what works best for each specific use case.
How much of Rubrik’s product development happens in India?
I’d say about 60 per cent of our R&D is in India today. Some products are almost entirely built out of India. Our cloud cyber resilience product was conceptualised in India and fully developed in India. It’s a big business and one of our fastest-growing, and a lot of the engineering leadership and team behind it are here. For every product, we have teams in India building as well. They’re not back office, and they’re not doing just bug fixes. They’re developing the core technology of these solutions.
Our move into the code space came through an acquisition about a year and a half ago, a company that did backup and recovery for GitHub and Azure DevOps. It was a small team, with founders in Australia, and we built more of a team around it. That team is mainly in India.
Where do you see things heading over the next year or so?
I think over the next 12 to 18 months, we’re going to go through a pretty rough patch. Open-weight models are going to be very powerful and will be discovering vulnerabilities, and people will not have advanced their vulnerability management programmes or adapted quickly enough. There are going to be a lot of cyberattacks. Hopefully, as we all mature, that will calm down, and we can build towards a world where software is vulnerability-free the moment you release it.
Whatever we do, we need to give people as broad access as possible. Some people will want to do this themselves. Others will say, I want to buy a product that does this for me, and services that give me the outcome, because I don’t have the people or the expertise. The more we can democratise these capabilities, the better.
Even the AI labs seem to be figuring this out as they go.
I listen to a lot of podcasts from AI researchers about how they’re trying to build guardrails into models. What’s so interesting is that everyone is learning together. You think these super-smart people know, but they don’t either. There are a lot of theories about how the pressures you put on training shape the outcomes. Clearly, what happened recently is that models were asked to do impossible tasks, and they found a way to do it.
