Rubrik Code Guardian Expands Project Hourglass, but Its Security Claims Face a Real-World Test

Rubrik introduced Rubrik Code Guardian on October 9, expanding Project Hourglass beyond runtime controls to inspect code repositories for exploitable attack chains. The private-preview service uses an Anthropic model inside an isolated testing environment, according to the company. It targets a growing conflict in software development: AI coding tools increase output, while security teams struggle to review that output at the same speed.

The expansion moves Rubrik closer to application security, a market where scanners already flag vulnerable code before deployment. Rubrik is making a different promise. Instead of producing another long list of possible defects, Code Guardian is designed to connect weaknesses across files, services, identities, and cloud boundaries. It then prioritizes paths that could create meaningful business damage.

That approach also creates the central test for Project Hourglass. An AI system can reason across a large repository, but enterprises still need evidence that its findings are accurate, reproducible, and safer than the code it reviews. Code Guardian is not generally available, and Rubrik explicitly says its features and performance remain subject to change.

Rubrik Code Guardian Extends Project Hourglass Into the Codebase

Project Hourglass is expanding from controlling coding agents at runtime to examining the software those agents help produce.

Rubrik originally launched Project Hourglass to help global systems integrators deploy Rubrik Agent Cloud around Anthropic’s Claude Code. That initial architecture focused on what an AI coding agent does while it is operating.

Its controls included behavioral guardrails, protection for prompt context, and Agent Rewind. Rubrik describes Agent Rewind as a way to reverse unintended actions taken by an agent. These functions address the operational risk of allowing software agents to read files, modify repositories, call tools, and interact with enterprise systems.

Rubrik Code Guardian adds a second layer. It examines a cloned copy of a customer’s source-code repository in an air-gapped environment, meaning the copy is isolated from production systems and external networks. Rubrik says this design lets teams conduct aggressive security testing without exposing live applications or sensitive source code to unnecessary operational risk.

According to the company’s Code Guardian release, the system uses Claude Mythos 5 through a specialized security harness. The model is intended to reason through multi-step threat scenarios rather than inspect each file as an independent unit.

That distinction matters because damaging vulnerabilities often emerge from combinations of otherwise modest weaknesses. A service might accept unsafe input, an identity role might have excessive permissions, and a cloud resource might be reachable through an overlooked route. A conventional tool can report each condition separately without showing how an attacker would connect them.

Rubrik says Code Guardian will look across source files, services, identity roles, and cloud perimeters to identify those chains. It will then test whether a suspected path is actually exploitable and score the finding according to business importance.

The goal is not simply to find more warnings. It is to reduce alert fatigue by helping engineering teams determine which warnings deserve immediate attention.

That is an important change in Rubrik’s security position. The company has traditionally emphasized data resilience, protected backups, and recovery after attacks. Code Guardian brings it earlier into the software lifecycle, before a vulnerable application reaches production.

Project Hourglass is also becoming a broader delivery alliance. AHEAD, Trace3, and World Wide Technology joined existing participants Cognizant, Deloitte, LTM, HCLTech, NTT DATA, and Wipro. These partners can help enterprises assess architecture, run controlled tests, and incorporate the technology into existing development and security processes.

Rubrik announced the expansion at its GSI Summit in Goa, India. The geographic setting is less important than the delivery model. Large enterprises often buy security programs through systems integrators, not through isolated product trials managed by a single development team.

Partners could therefore determine whether Rubrik Code Guardian becomes an operational control or remains an interesting private-preview demonstration. They will need to connect its results with ticketing systems, software pipelines, identity controls, and existing application-security tools.

The private-preview label places a firm limit on the announcement. Rubrik says the service is being offered to selected design partners on an “as is” basis. It is not generally available, and the company makes no guarantee that every described capability will reach a commercial release.

That qualification is central to the story. Rubrik has outlined an ambitious architecture, but customers cannot yet judge it through broad deployment data, independent benchmarks, or a stable production release.

Why AI Code Security Is Becoming an Enterprise Bottleneck

The pressure comes from a widening speed gap between automated code creation and human security review.

AI coding assistants can generate features, tests, configuration files, and infrastructure code in minutes. That speed changes the economics of development, but it does not eliminate the need for review. It can instead increase the amount of code that security teams must evaluate before a release.

The risk is not that every AI-generated function contains a vulnerability. The problem is that plausible code can pass a quick visual review while preserving unsafe assumptions about permissions, inputs, dependencies, or system boundaries.

A 2025 Veracode evaluation reported that tested models introduced a detectable OWASP Top 10 vulnerability in 45 percent of its task results. The company’s code security study used controlled programming tasks in which implementations could follow secure or insecure patterns.

That figure should not be treated as the vulnerability rate for all production software. Controlled tasks differ from maintained enterprise repositories, and results depend on the language, prompt, model, and test method. Still, the study illustrates why functional correctness cannot serve as a substitute for security validation.

The risk also extends beyond generated source code. Coding agents can access repositories, terminals, issue trackers, package managers, and deployment tools. A harmful instruction embedded in retrieved content can redirect an overprivileged agent, while an ordinary mistake can propagate across many files.

OWASP describes excessive agency as a condition in which a model receives unnecessary functionality, permissions, or autonomy. Its excessive agency guidance recommends limiting tool access, minimizing permissions, requiring approval for consequential actions, and validating outputs before execution.

Those controls focus on what an agent is allowed to do. Code Guardian addresses a related but distinct question: what security weaknesses exist in the codebase after humans and agents have contributed to it?

Rubrik cites its own Zero Labs research to explain the urgency. The company says 86 percent of surveyed cybersecurity and IT leaders expect AI-agent adoption to outpace their organizations’ security guardrails within one year. Because that number comes from Rubrik’s research, readers should treat it as evidence of customer concern rather than independent proof of Code Guardian’s effectiveness.

The broader concern is well established. Autonomous agents can operate with machine identities, credentials, and tool permissions. They can also perform sequences of actions faster than a person can review each step.

This makes the software repository only one part of the attack surface. Security teams must protect the model’s context, the agent’s permissions, the generated code, the deployment pipeline, and the data affected by a failed action.

Project Hourglass now tries to cover several of those layers. Rubrik Agent Cloud focuses on agent behavior and recovery. Code Guardian focuses on repository analysis and attack-chain discovery. Rubrik’s existing resilience products provide the recovery layer if prevention and runtime controls fail.

That end-to-end positioning is commercially attractive, but it also creates integration questions. Enterprises already use static application security testing, software composition analysis, secrets detection, cloud-security posture tools, and manual penetration testing.

Code Guardian must show that it contributes something those products cannot provide efficiently. Finding a hypothetical weakness is not enough. The service needs to explain how an attacker reaches it, which assets become exposed, and why the finding should outrank competing remediation work.

This is where AI code security becomes a prioritization problem. A scanner that doubles the number of alerts without improving decisions can make a security program slower. An effective reasoning system must reduce uncertainty, not merely produce longer reports.

For engineering leaders, the immediate lesson is practical. Faster code generation requires stronger controls at repository, identity, and runtime levels. Teams also need durable records of architectural decisions, threat assumptions, and remediation work.

A searchable engineering knowledge base can preserve that context across security, development, and operations teams. It does not replace code testing, but it helps reviewers understand why sensitive components were designed in a particular way.

Project Hourglass Pits Attack-Chain Reasoning Against Alert Volume

Rubrik’s main bet is that AI can prioritize realistic attack paths better than tools that examine weaknesses in isolation.

Traditional static analysis evaluates source code without executing the application. It can identify known unsafe patterns, such as unsanitized inputs, dangerous function calls, or weak cryptographic choices. Software composition analysis examines external packages and known vulnerabilities in dependencies.

These methods remain essential because they are repeatable, familiar, and suited to automated development pipelines. However, they can generate false positives or isolated findings that lack business context.

A warning in an unreachable test component does not carry the same risk as an exploitable flaw in an internet-facing authentication service. Yet both can appear in the same queue unless a person or another system reconstructs the surrounding architecture.

Rubrik Code Guardian is designed to perform more of that reconstruction. The company says its model can reason across files and services, include identity relationships, and consider cloud boundaries. The resulting output is supposed to describe an attack chain rather than a disconnected defect.

Consider a hypothetical enterprise application with three weaknesses. One API accepts an improperly validated parameter. A service identity can read a sensitive storage bucket. A background worker trusts messages from the API.

A file-level scanner might generate three tickets. Attack-chain analysis would ask whether an attacker can use the parameter flaw to control a message, trigger the worker, inherit the service identity, and reach the storage bucket. If that sequence works inside the isolated copy, the security team gains a clearer remediation priority.

This is the mechanism behind Rubrik’s business-impact claim. The model is not valuable merely because it can read more code. It becomes useful if it can distinguish a plausible chain from a theoretical combination and explain its conclusion to human reviewers.

Anthropic has already presented model-assisted vulnerability discovery as a defensive use of advanced coding models. In February 2026, the company said Claude Code Security had found more than 500 vulnerabilities in production open-source projects. Its security research announcement described a process that combines model analysis with human review and coordinated disclosure.

Anthropic has also published a vulnerability dashboard that records findings after external triage and maintainer review. That workflow matters because a model’s initial suspicion is not equivalent to a confirmed vulnerability.

Rubrik is taking this general capability into a controlled enterprise environment. Instead of scanning public open-source repositories, Code Guardian is intended to examine private customer code through participating partners.

The air-gapped clone provides two potential advantages. First, it can reduce the chance that proprietary code leaks into an external service or reaches a live production system. Second, it gives the testing process room to probe aggressively without affecting customers or operations.

Isolation does not settle every security question. Enterprises will still need details about how repository copies are created, where model inference occurs, how results are retained, and which partner personnel can access findings.

The term “air-gapped” can also cover different technical arrangements. A physically separated environment, a tightly restricted private cloud, and a logically isolated network do not provide identical assurances. Rubrik’s public announcement does not provide enough architecture detail to compare those models.

The competitive test will center on evidence quality. Established application-security vendors can add AI explanations and contextual ranking to their existing scanners. Cloud-security vendors can correlate identities, services, and reachable assets using production telemetry.

Rubrik brings different assets. It has relationships around protected enterprise data, recovery workflows, and cyber resilience. Project Hourglass also gives it systems-integrator partners capable of joining code analysis with broader infrastructure decisions.

The strongest version of Rubrik’s strategy combines those assets. Code Guardian would identify the chain, Agent Cloud would constrain agent behavior, and Rubrik’s recovery controls would restore affected code or data after an incident.

The weaker version creates another console with overlapping alerts. Private-preview customers will need to determine which outcome they are seeing.

The Hard Part Is Validating the AI Reviewer

An AI system reviewing AI-assisted code creates a verification loop that cannot be resolved by model confidence alone.

Rubrik says Code Guardian will verify findings for actual exploitability. That is a more demanding claim than identifying suspicious patterns. Exploitability depends on configuration, deployment state, reachable inputs, identity permissions, and environmental controls.

A cloned repository may not contain every fact needed to reproduce the production environment. Infrastructure settings can live in separate systems. Runtime identities can differ from declared roles. Network policies can change after the clone is created.

This means the system’s attack path can be logically coherent while still being impossible in production. The opposite problem also exists. A repository-focused test might miss a dangerous path created by runtime drift, an undocumented integration, or a compromised credential.

Private-preview trials should therefore measure more than the number of issues found. They should track confirmed exploitable chains, rejected findings, duplicate alerts, time to validation, remediation time, and defects missed by the system.

Independent comparison will be especially important. A design partner should run Code Guardian beside its existing scanners and penetration-testing process. That creates a baseline for determining whether the service discovers unique risks or repackages known findings.

Security teams also need reproducible evidence. A useful report should identify the relevant code paths, required permissions, preconditions, affected assets, and steps used to validate the chain. Reviewers must be able to challenge the model’s reasoning without accepting a black-box risk score.

Rubrik has not published benchmark results for false-positive rates, false-negative rates, repository coverage, analysis time, or vulnerability classes. Its announcement also does not disclose how performance changes with large monorepositories or uncommon programming languages.

Those omissions are reasonable for an early preview, but they limit what enterprises can conclude. Code Guardian is a proposed security control, not an independently validated replacement for existing application-security testing.

The underlying model creates another concentration risk. Rubrik is relying on Anthropic technology to inspect code that may have been created with Claude Code or other AI assistants. A capable model can still share blind spots with the systems that generated the code.

Model diversity does not automatically solve that problem, but independent testing methods can help. Deterministic scanners, human penetration testers, runtime observations, and separate models can each challenge different assumptions.

OWASP’s broader agent security framework treats agentic systems as combinations of models, tools, identities, memory, and external services. That perspective argues against relying on any single automated reviewer.

There is also a governance issue. A model can flag a path as business-critical only if it receives accurate information about business importance. The repository alone may not reveal which service processes regulated data, supports a major customer, or controls a critical operational workflow.

Partners will need to supply that context. Doing so requires cooperation across application owners, security teams, cloud administrators, identity teams, and business leaders.

Systems integrators can coordinate those groups, which helps explain Rubrik’s alliance-first strategy. However, partner-led delivery can produce uneven results if implementation practices differ. Certification and direct engineering support may reduce that variation, but Rubrik has not yet published operational outcome data.

The company’s recovery positioning also deserves scrutiny. Instant codebase recovery can restore known-good files after an unintended change, but restoring code does not automatically reverse every consequence.

A compromised agent could expose a secret, trigger an external transaction, alter a third-party system, or modify production data. Those effects require incident response beyond repository rollback.

Project Hourglass should therefore be evaluated as a layered control, not as a guarantee. Guardrails can reduce dangerous actions. Code testing can find vulnerable paths. Recovery can limit damage. None removes the need for least-privilege access, human approval, secure development practices, and incident planning.

That is the core tradeoff. AI reasoning can examine relationships that rule-based tools struggle to connect, but the reasoning itself requires validation. Enterprises gain speed only when the verification burden becomes smaller than the problem being automated.

Rubrik Code Guardian Now Has Three Tests to Pass

The next evidence must come from deployment results, independent comparison, and a clearly defined production architecture.

The first signal is the quality of design-partner outcomes. AHEAD, Trace3, WWT, and the existing Project Hourglass participants have access to enterprises with complicated repositories and mature security programs.

The most useful results will not be promotional statements about finding “more” risks. Buyers need anonymized examples showing which attack chains existing tools missed, how Code Guardian validated them, and how quickly teams completed remediation.

Confirmed findings would strengthen Rubrik’s argument that model-based reasoning improves prioritization. High rejection rates or large review workloads would weaken it.

The second signal is the path from private preview to general availability. Rubrik’s current release includes an explicit warning that Code Guardian may change, arrive late, or never become generally available.

A production release should clarify supported languages, repository-size limits, deployment models, data handling, model update policies, retention controls, and integration with development pipelines. It should also explain how customers audit actions taken during testing.

General availability alone would not prove effectiveness. However, stable documentation and contractual security commitments would show that Rubrik is prepared to move beyond a controlled experiment.

The third signal is the competitive response. Application-security and cloud-security vendors already possess code scanners, vulnerability databases, dependency intelligence, and production context. They have clear incentives to add agentic attack-chain analysis.

If those vendors produce comparable reasoning through tools customers already use, Rubrik will need to differentiate through recovery, isolation, or partner delivery. If competitors struggle to correlate code with identity and business impact, Project Hourglass gains a stronger opening.

Anthropic’s own security products are another reference point. Claude Code Security demonstrates that the model provider sees vulnerability discovery as a direct product category. Rubrik must explain how its security harness, enterprise context, and recovery architecture add value beyond access to the underlying model.

Developers and enterprise buyers should watch these signals before treating Rubrik Code Guardian as an established control. The announcement identifies a real problem and proposes a credible mechanism, but the evidence remains preliminary.

For development teams, the practical response should not wait for one vendor’s release. Inventory where coding agents operate, restrict their credentials, record consequential changes, and preserve human approval for sensitive actions. Continue using deterministic scanners and independent testing even when an AI reviewer is available.

Security leaders should also ask a harder question: does a new tool shorten the path from finding to verified remediation? A system that discovers sophisticated chains but overwhelms reviewers does not solve the operational bottleneck.

Rubrik Code Guardian will matter if Project Hourglass turns model reasoning into repeatable evidence that engineers can act on. Its private preview is the beginning of that test, not the result. Over the next few months, buyers should look for validated attack chains, transparent error rates, and a production architecture that protects the code being inspected.