Frontier AI has changed how software gets tested. It lets security teams scan more code, explore more attack paths, and find exploitable conditions faster. At the same time, bad actors are also using frontier AI to find and exploit vulnerabilities faster than ever.
Commvault’s vulnerability management program leverages a range of frontier AI models, and we pair every discovery with a disciplined process to validate, prioritize, and remediate.
The Testing Baseline Has Changed With AI Partnerships
Commvault’s participation in Anthropic’s Project Glasswing expanded our use of frontier AI models to include Claude Mythos 5.1 in our vulnerability management.
In addition, Commvault joined forces with NVIDIA when the AI enterprise formed the Open Secure AI Alliance to build open-source security tools for AI models, agents, and infrastructure.
These partnerships do two jobs. Glasswing expands the models we can use to discover vulnerabilities in our code. The Alliance gives defenders open tools they can inspect, adapt, and run on their own infrastructure. Neither replaces process. Whatever the models find, one governance framework decides what happens next.
What We’re Doing at Commvault
We’ve been handling frontier AI–found vulnerabilities the same way we handle any other vulnerability: Security SMEs and Engineers confirm each finding, we fix it through an enhanced development process, and we disclose only after the fix is in place.
The results so far confirm the premise: discovery of real, exploitable issues that existing tooling hadn’t surfaced – and now we can remediate them.
What We’re Learning
Discovery is no longer the hard part. Acting on what you find is.
When AI surfaces more findings faster, the issue becomes whether organizations can triage, prioritize, and remediation vulnerabilities at speed. Finding more flaws without keeping pace to fix them quickly can leave you more exposed, not less. So we aim to match every investment in discovery with equal investment in response: risk-based triage, consistent remediation timelines, and coordinated disclosure process.
The Controls That Keep It Safe
We run AI-assisted scans on isolated hardware or in Commvault-managed cloud infrastructure, with air-gapped paths for open-source models.
Our engineers confirm whether each AI-generated finding is an actual vulnerability by testing it in a representative customer environment before any remediation begins. Severity depends on exposure, exploitability, and impact – not on how we found the flaw. Static analysis, fuzz testing, manual review, and third-party penetration testing stay in place. AI adds coverage depth.
The Bottom Line
Commvault has a vulnerability management process disciplined enough to respond to whatever frontier AI surfaces – at scale, consistently, and without gaps. That is how we build our business, and it is how we protect yours.
To learn more, visit theCommvault Trust Center.Bill O’Connell is Chief Security Officer at Commvault.
