The most advanced AI models can now find and link software weaknesses faster than the best human hackers. Rubrik, which does most of its research in India, is turning that power on their customers’ own code, but most organisations still fax flaws too slowly to keep pace
At a typical financial services company, for example, fixing a flaw in its software can take five months: three to plan the fixes and two more to roll them out. Artificial intelligence can now find such flaws in minutes.
That gap worries Anneka Gupta, Chief Product Officer at Rubrik, the US-listed AI and cyber resilience company. “You cannot wait for Patch Tuesday anymore,” she said at Rubrik’s partner summit in Goa, referring to the monthly day on which software makers release their fixes and many companies schedule theirs.
The clearest example is Mythos, an AI model built by Anthropic, the US company behind the Claude chatbot. Mythos can read through millions of lines of software, spot weak points and string them together into a way in, work that once took teams of skilled hackers weeks. Anthropic considers it so powerful that it has not released it to the public. It has shared Mythos only with a small group of companies, Rubrik among them, to find and fix flaws before criminals can exploit them.
That head start will not last long. Gupta expects freely available AI models, which anyone, criminals included, can download and use, to reach a similar level within 12 to 18 months, well before most organisations have sped up how they fix flaws. “We’re going to go through a pretty rough patch,” she said. “There’s going to be a lot of cyberattacks.”
Companies are not slowing down to prepare. In a study by Economist Enterprise, supported by Rubrik, 98 per cent of 804 senior executives across nine countries, including India, said they had already faced a disruptive incident involving an AI agent, software that acts on its own inside company systems. Nine in ten admitted deploying such agents faster than their security teams could keep up. Rubrik’s research arm, Zero Labs, found that 86 per cent of security and IT leaders expect agents to outrun their safeguards within a year.
Hack yourself first
Rubrik built its name helping businesses recover from ransomware. Its answer to this new threat is to use the attacker’s own weapon. Its newest product, Code Guardian, previewed in September and showcased to partners in Goa, puts the latest version of Mythos to work for the defenders.
Code Guardian attacks a company’s code the way a skilled hacker would, looking for chains of small weaknesses across different parts of a system that ordinary scanning tools miss. It never touches live systems. Instead, it works on a sealed-off backup copy of the code that Rubrik already keeps for its customers.
Those chains are what make the difference, Gupta explained. Every organisation lives with thousands of known minor flaws it never fixes, because each one on its own is too buried to be reached from outside. The AI finds ways to link them into a real path for an attacker. When Rubrik ran it on its own code, its engineers were taken aback. “Once you see it, you can’t unsee it,” Gupta said. Finding those paths by hand “would have taken hundreds, thousands of hours.”
Safety is built in at every step. Code is screened before it reaches the AI and the results are screened again before customers see them, with human checks along the way rather than letting the AI run unsupervised. “There’s a lot of checks and balances,” Gupta said. Each finding is tested to confirm it is real and ranked by how much harm it could do, so companies get a short list of what to fix first rather than a flood of alarms.
“Engineering teams are turning to AI models to accelerate software delivery, but speed cannot compromise security or architectural integrity,” said Alok Agrawal, Rubrik’s Chief Solutions Officer.
Indian IT in the loop
To take Code Guardian to enterprises, Rubrik has widened Project Hourglass, its partner alliance. Tata Consultancy Services, Wipro, HCLTech, LTM and Cognizant are part of it, alongside Deloitte, NTT DATA, AHEAD, Trace3 and WWT. The partners will not operate the AI. They receive the findings and help clients decide where to start and carry out the fixes, because many organisations, Gupta said, “don’t have the people, they don’t have the expertise always to do it.”
India is also where much of Rubrik’s technology is built. About 60 per cent of its research and development happens in the country, Gupta said, and these teams are “developing the core technology,” not doing back-office work. One of Rubrik’s fastest-growing businesses, a cloud cyber resilience product, was conceived and built in India.
Keeping AI agents in check
Code Guardian is the newest piece of a broader set of tools Rubrik has built for a world where AI agents do real work. Rubrik Agent Cloud watches what these agents do inside company systems and stops them when they step out of line. Its companion, Agent Rewind, works like an undo button, reversing an agent’s mistakes.
That safety net is rarer than it should be. Only 30 per cent of organisations in the Economist Enterprise study had reliable, fully tested ways to undo what an AI agent had done.
Together, the tools form a chain: Code Guardian checks the code before it goes live, Agent Cloud supervises the AI agents that write and change it, and Rewind offers a way back if something still goes wrong.
Gupta admits that no one, not even the people building these AI systems, fully knows how they will behave. “Everyone is learning together,” she said. Rubrik’s bet is that in an age of AI that hacks, the best defence may be AI that hacks you first.
The author is a freelance tech journalist; Views presented are personal.