Rubrik's AI found more bugs than Rubrik could fix, and hiring was the wrong answer

Rubrik joined Anthropic's Project Glasswing in June, when the program expanded to roughly 150 organizations across 15 countries, and got access to Mythos Preview ^[1]. After a month, CTO and co-founder Arvind Nithrakashyap says the company did not have the engineering capacity to keep up with what the model was finding ^[2][3]. The consequence worth noting is not that the model works; it is that the constraint moved downstream, into triage and remediation, where adding people does not help.

Nithrakashyap says Mythos was immediately surfacing complex vulnerability chains that Rubrik's existing security tools and methodology had missed, including relationships between components spread across large codebases that neither a conventional scan nor a single engineer's review would catch ^[4]. That volume produced a prioritization bottleneck the existing team was not built for ^[5]. "When we first saw the readout of potential issues, our immediate instinct was to treat it as a capacity problem," he told The New Stack, and the company briefly considered hiring more human reviewers ^[6]. Then: "We quickly abandoned the plan, as we realized there was no way human-driven remediation could keep pace with AI-speed discovery" ^[7].

What replaced headcount was plumbing. Rubrik put together a cross-functional engineering and infosec team and chose automation over more reviewers ^[8]. The work went into a harness that, in Nithrakashyap's description, "manages tool calls and checkpoints, adds business context, security context, and trust boundaries," with the explicit goal of reducing the number of findings that reach an engineer at all ^[9]. Operationally, that means one whole-repository scan, then progressively narrower passes seeded by the first results, filtering noise before anything is routed to a team ^[10]. Only after those targeted passes existed, he says, did the workflow produce findings engineers could act on ^[11].

The more interesting decision is where they stopped. Nithrakashyap describes a recurring conflict between trustworthy automation and maximum automation ^[12], and says Rubrik confined automated remediation to a deliberately narrow set of vulnerability classes where machine fixes are reliable and well defined, routing everything else to humans ^[13]. His summary: "Mythos has shown us that AI actually increases the demand for engineering rigor in the systems that surround it" ^[14].

None of this is new as a thesis. A dev.to post from Instasla argues detection has improved while remediation has not, and that the resulting security debt is not a talent or budget problem but a developer-experience one ^[15][16]. It cites an analysis of the 2025 DORA dataset in which bugs per developer rose about 54% and incidents per pull request by more than 240% as AI adoption grew ^[17], and IDC research from February 2025 putting developer time on actual application development at roughly 16% ^[18] - about 6.4 hours of a 40-hour week ^[19]. Treat the friction math as illustrative, not as a budget: 23 minutes to regain focus ^[20] times the 12 to 15 daily context switches those surveys claim ^[21] would consume 4.6 to 5.75 hours a day ^[22].

Worth flagging that the entire Rubrik account comes from one executive, with no published counts of findings, fixes, or false positives ^[23].

Watch whether the tightly-scoped automated classes widen, and what happens to the harness when Mythos changes underneath it.