AI, where it's actually trustworthy

AI explains the fix. It never decides what's vulnerable.

Many tools say "AI-powered" without saying what that means. Here's exactly where AI touches Drubix, and where it doesn't.

Detection is fully deterministic AI only writes and summarizes Works fully without AI

The short version

How a finding is made, and where AI steps in

Everything up to the fix is plain data matching. AI only joins at the very end, to put it into words.

Real advisoriesFetched from drupal.org's security feed

Your real versionsConfirmed by the connector module

Deterministic matchSame input, same result, every time

Finding + exact fixThe version the advisory specifies

AI writes it upPlain-English explanation & summary

No AI involved AI helps with the writing

The boundary

A clear line, drawn on purpose

AI never…

Decides whether a module version is vulnerable
Chooses which version to upgrade to
Decides whether Autopilot merges a PR (that's fixed rules: patch-level only, your CI result, your client's answer)
Claims an AI agent caused a specific config change
Invents a finding, a count, or a detail that isn't in your data

AI does…

Write the pull request description for a fix that's already decided
Explain the upgrade, always to the advisory's exact fixed_version
Flag AI-agent activity that coincides with real risk, labelled as correlation, not proof
Turn real severity counts into a short paragraph a client can read

In the product

Three places you'll see AI

Fix pull requests

Drubix opens a real PR with the exact Composer bump. AI writes the description.

Example PR descriptionUpdates Webform to 6.2.3 to close a cross-site scripting issue (SA-CONTRIB-2026-014)…

For a confirmed finding, Drubix opens a real pull request against your repository with the exact Composer version bump the advisory specifies, already committed on a branch. AI writes the explanation: what the finding is and why it matters, in plain language. If AI generation isn't configured, or fails for any reason, the PR still opens with a complete, accurate fallback description.

AI-agent activity

When Drupal's AI agents change config around the same time as a real risk, you'll know.

Example findingAI agent activity overlaps with new config drift on user.role.editor. Correlation, not proof.

Drupal's own AI agents can now create fields, content types and other configuration from natural-language instructions, sometimes with no developer in the loop. Drubix reads Drupal's AI activity log and correlates it with the config drift and permission audits it already collects. When both appear in the same window, it's surfaced clearly, and every such finding says explicitly that correlation isn't proof.

Report summaries

Every PDF report opens with a short, plain-English paragraph for non-technical clients.

Example summaryThis month we found 1 critical and 2 high issues. The most urgent is an outdated Webform module…

Real severity counts and the actual most urgent finding are computed first; AI only turns them into a sentence someone will read instead of a 12-page technical appendix.

Why the line is there

A confident false positive is bad. A real vulnerability that a model quietly dismissed is worse.

Read the full reasoning

Security tools that let a model take part in the detection step carry exactly that risk. The approach trusted by security teams draws the same boundary Drubix does: deterministic analysis for the finding itself, with generative AI layered on top only for explanation and remediation. It's the only version of an "AI security tool" a security-conscious buyer should trust.

ReproducibleThe same site and advisory data always produce the same finding.

TraceableEvery finding points back to a real, published advisory.

ReadableAI makes it easy to understand, without changing what it says.