A month with Anthropic’s Mythos left Rubrik rethinking remediation

A month with Anthropic’s Mythos left Rubrik rethinking remediation Data resilience company Rubrik Inc. today said a month of scanning its own code with Anthropic PBC’s Mythos Preview model surfaced so many potential security issues that it rebuilt its review pipeline rather than hire reviewers. The details came in a blog post from Rubrik co-founder and Chief Technology Officer Arvind Nithrakashyap. Rubrik got access in June to Project Glasswing, Anthropic’s limited program that gives defenders early use of Mythos Preview, after the company opened it to another 150 organizations. Anthropic has kept that model out of general release. Mythos finds software flaws and strings them into working attack chains too well to hand out freely. Rubrik pulled engineers and infosec staff onto a tiger team. Most of their work went into the harness, which is the software layer that wraps the model and manages its tool calls and checkpoints. Rubrik’s version also feeds in business and security context. It encodes where the trust boundaries sit for a vendor whose customers treat it as a last line of recovery. Nithrakashyap wrote that none of that belongs in a prompt: “Prompts drift. Harness architecture doesn’t.” Scanning started wide. Whole repositories, every file, no assumptions about where the problems were likely to be. Later passes narrowed, seeded by patterns the first rounds exposed. Rubrik reports a significant reduction from raw findings to validated priority issues, though the post puts no numbers on any of it. What surprised the team more, according to Nithrakashyap, was how much engineering time went into deciding what not to automate. Machine remediation covers a deliberate subset of vulnerability classes, the ones Rubrik judges reliable and well-scoped. Anything outside that set gets a structured plan and richer context, and an engineer owns the fix. “In security, trustworthy automation and maximum automation pull in different directions,” Nithrakashyap wrote. “We chose the former.” Anthropic has reached much the same conclusion across the wider program. Its May 22 update counted more than 10,000 high- or critical-severity vulnerabilities found by partners, with a 90.6% true positive rate across 1,752 flaws sent for outside assessment. Patching lagged. Of 530 vulnerabilities reported to open-source projects, 75 had been fixed by the time the update ran, and high and critical bugs were taking about two weeks each. Anthropic launched Glasswing on April 7 and put $100 million in application programming interface credits behind it. Roughly 50 partners went in first, Microsoft Corp. and Apple Inc. among them. June’s expansion pushed well outside the technology industry. Power, water and healthcare operators got access. So did the North Atlantic Treaty Organization and the European Union’s Agency for Cybersecurity. No vulnerability counts or fix rates have come out of Rubrik yet. The post sets no timeline for releasing any. Nithrakashyap ended it with an invitation to other teams running similar work to compare notes. Image: SiliconANGLE/GPT Image 2 A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. Are you AWS customer? Support SiliconANGLE Financially by buying your AWS services from our Marketplace portal page and links. About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.