On September 11, 2026 the EU's Cyber Resilience Act began requiring manufacturers to report any actively exploited vulnerability in their products within 24 hours, with a full notification after 72 hours. But there’s a problem: the new requirement assumes a company knows which flaws are in its products, and can act on them once it does.
That was a reasonable assumption until this year, when CERT-EU, the central cybersecurity hub for the EU warned about the economics of vulnerability discovery. In their words: "Capabilities that required nation-state resources and months of expert labour a few years ago are now available to a far broader set of actors."
The elephant in the room: the volume of potential vulnerabilities that can be exploited is growing, while our capacity to fix flaws is not keeping pace. Left alone, this leads to a world where we staff up compliance teams to chase down vulnerabilities after they’ve been exploited. We need some ability to bridge the gap between vulnerability discovery and fix capacity.
The Paradox, By The Numbers
In the first half of 2026, 35,364 vulnerabilities were published, 49.5% more than the same period a year earlier. Of the vulnerabilities that entered VulnCheck's exploited catalogue during that time, 495 showed evidence of real-world exploitation, and 23.4% of those were already being exploited on or before the day they were made public. Google's M-Trends 2026 records the mean time to exploitation at roughly negative seven days.
Overall, the numbers look alarming: frontier models didn't create code vulnerabilities, but they increased the likelihood of an exploit succeeding before a patch can be created. This dramatically increases the cost of ignoring exploits.
But it gets worse: Anthropic reported that open-source repository maintainers are asking to slow disclosure rates due to patch capacity, while Veracode data shows the median organization fixes only about 10% of discovered flaws monthly.
So how do you close the gap between inexpensive AI vulnerability discovery and expensive software fixes?
Rubrik transformed our internal harness into a dedicated product. Rubrik Code Guardian runs Claude Mythos 5 against an air-gapped copy of a code repository, validates which attack chains are actually exploitable, and pushes confirmed findings into a developer workflow paired with a proposed patch.
The bottom line: Rubrik taught Mythos to reason like an attacker.
The Journey to Frontier AI Resilience
Joining Anthropic's Project Glasswing allowed Rubrik to run Mythos against our architecture through a custom harness. In the process we quickly realized that running an attacker's reasoning against your own code feels less like a traditional audit and more like an inoculation.
Unlike static security testing tools that scan file-by-file against static rules, Mythos assembled individual lower-level bugs into complex, working attack chains. While effective, this depth of discovery created an immediate operational bottleneck: clearing our highest-priority findings alone would have taken six to ten months.
The irony of scale is complexity, and complexity compounds the chance that low-level bugs can be chained into exploits. Here are three things we learned from our own journey to frontier resilience:
1. Bring AI to the table on remediation: The bottleneck is no longer discovery; it is validation and patching. The same model that assembles an attack chain can be redirected to create the remediation guidance an engineer needs to act on. We are not diminishing human work. We increase it, and the challenge ahead is to re-imagine it.
2. Frontier security comes down to context: A frontier model pointed at a large codebase returns generic findings. What made ours useful was a harness supplying our threat model, our trust boundaries, and an understanding of the crown jewels of our systems and how they are configured.
3. Start small and match discovery to your capacity to fix: Repeated sweeps across a large estate are expensive and will not improve your patch rate. Begin with quarterly deep sweeps supplemented by event triggers on major authentication changes, pre-release work on critical systems, and newly added repositories, and iterate towards continuous as your fix rate improves.
Most AI investment cases in the enterprise are built on the premise of needing fewer people. But our world keeps getting more digital and more regulated, while frontier models have dramatically lowered the cost of exploiting their flaws.
There is no question that we need AI at the table to remediate the mountain of flaws that can now be exploited. The harder question is whether you are prepared to reimagine your work and your readiness for it.