From insight to fix, in one conversation
Designing how security analysts investigate and fix risky AI agent behavior with Rubrik AI, bringing the context to them instead of making them search for it.
Context
Rubrik AI is an AI agent built into Rubrik.
People ask Rubrik AI to do things for them in a chat. When an answer is easier to see than to read, it opens a canvas beside the chat with the actual product views it’s using, so people can follow along as it works.
Rubrik Agent Cloud keeps a company’s AI agents in check. It finds every agent in use, along with the tools, apps and data each one can reach, and watches what they do. Every action is checked against the company’s policies, rules written in plain English, and when something breaks one, Agent Cloud raises an alert. It also surfaces insights: risky patterns worth a closer look, even when no policy covers them yet.
Security analysts and IT admins use Agent Cloud to monitor their agents, investigate what went wrong and fix it. We brought it into Rubrik AI, so they could do all of that in one conversation, with Rubrik AI tying the pieces together.
Opening Rubrik AI from the Agent Cloud dashboard.
The opportunity
The context was all there. Connecting it was still up to the analyst.
Agent Cloud already had everything an investigation needs: insights, alerts, every agent and what it can access, what it did, and the policies around it. But working through an investigation meant the analyst had to plan every next step: what to look at, where to find it, and what to do about it.
Rubrik AI lays those steps out for them. It ties the pieces together, explains what they mean and suggests what to do next, so analysts only have to focus on making the right decision.
- What am I looking at?
- Who or what is involved?
- Where’s the related data?
- Is this actually risky?
- What should I do?
- Where do I do it?
- Pulls in the related context
- Explains what it means
- Shows the evidence in the canvas
- Suggests the next step
- You make the call
Instead of planning each step, analysts follow the path Rubrik AI lays out and focus on the decision.
Solution
One conversation, from question to fix.
Analysts can now investigate and act on anything in Agent Cloud by talking to Rubrik AI. The agent explains what happened and suggests what to do in the chat, while the canvas on the right shows exactly what’s happening, so analysts can check the evidence for themselves.
Here’s one example, starting from an insight on the dashboard: Claude Code, a coding agent, deleted a repository on GitHub, something it had never done before.
Start from what matters
As soon as the analyst logs in, Rubrik AI opens on its own and flags what needs attention first: here, a critical insight that Claude Code deleted a repository on GitHub. One click starts the investigation, with that insight already loaded as context.
The agent explains, the canvas shows
Rubrik AI explains what happened: Claude Code deleted the acme-platform repository, even though it had only ever read and written code before. At the same time, the canvas opens the agent’s access map, where the new shell tool it used stands out.
From there, the analyst opens the affected session and walks through its timeline: a policy stopped the agent from committing a credentials file, then it moved on and ran the command that deleted the repository and its full history.
Rewind, right from the conversation
Rubrik AI stages a rewind to just before the deletion and lays out what will be restored. The analyst confirms, and the canvas shows the rewind completing: the repository is back on GitHub with all of its history.
Turn the fix into a policy
With the repository restored, Rubrik AI points out that Claude Code can still run shell commands, so the same thing could happen again. It recommends a policy to block coding agents from running destructive shell commands on GitHub and drafts it in the canvas.
The analyst can review its scope, examples and definitions or ask follow-up questions, then create it, all in the same conversation.
The policy at work
The next time a coding agent tries something similar, Agent Cloud stops it as it happens. Here, a developer asks Claude Code to clean up old repositories, and it tries to delete one. The new policy blocks the command, and Claude Code suggests safer options instead, like archiving the repository.
Key decisions
Four decisions shaped the design.
- Chat for intent, canvas for evidence
The conversation explains and suggests; the canvas shows the real product views behind it. Analysts can check what the agent says instead of having to take its word for it.
- Start where the analyst already is
Rubrik AI opens on its own after login, with the most important insight already flagged and loaded as context, so the conversation starts at the right place instead of at a blank prompt.
- Suggest, then ask
Rubrik AI recommends the next step, but the analyst confirms every action that changes something, like a rewind or a new policy.
- Fix and prevent in one flow
Suggesting the policy right after the rewind keeps prevention in the same conversation as the fix, while the full story of what happened is still on screen.
Outcome
From my designs to Rubrik’s main stage.
Rubrik’s leadership demoed this experience live at Rubrik Forward 2026, Rubrik’s annual conference. On the main stage, they showed Rubrik customers and sales teams how Agent Cloud and Rubrik AI take an analyst from insight to fix in one conversation.
The design on the main stage at Rubrik Forward 2026.
What’s next
From demo to product.
This integrated experience is now being built, and is planned to be generally available in early 2027.