Rubrik expands Project Hourglass to test AI-generated code for cyber risks

The expanded alliance adds AHEAD, TCS, Trace3 and WWT, as Rubrik introduces Code Guardian to test cloned code repositories in isolated environments.

Rubrik is expanding its Project Hourglass partner alliance to include Rubrik Code Guardian, a tool designed to identify and assess vulnerabilities in software code repositories using Anthropic’s Claude Mythos 5. The expansion adds AHEAD, Tata Consultancy Services (TCS), Trace3 and World Wide Technology (WWT) to an alliance that already includes Cognizant, Deloitte, LTM, HCLTech, NTT DATA and Wipro.

Announced at the Rubrik GSI Summit in Goa on October 9, 2026, the expansion brings code-level security testing into an initiative originally launched to help enterprises secure their use of Anthropic’s Claude Code through Rubrik Agent Cloud.

The development comes as organisations face growing challenges in governing AI agents and their access to enterprise systems. According to Rubrik Zero Labs, 86% of cybersecurity and IT leaders expect AI agents to outpace their organisations’ security guardrails within the year.

Testing code in isolation

Rubrik Code Guardian uses Anthropic’s Claude Mythos 5 within a specialised security harness to evaluate code repositories against multi-step threat scenarios. Rather than testing live production environments, it examines cloned copies of customer repositories in air-gapped environments.

The approach is intended to identify vulnerabilities that may emerge across interconnected parts of an application, including files, services, identity roles and cloud perimeters. By examining how weaknesses could be linked into attack chains, the system aims to identify risks that conventional static analysis tools may miss.

Rubrik also says the system will verify the exploitability of findings and prioritise them according to business criticality. This is intended to help security teams focus on vulnerabilities with practical consequences rather than manage a large volume of alerts.

The company said Code Guardian is currently in private preview and accepting select design partners. It is not generally available, and its features and performance are not guaranteed.

Extending agent security

Project Hourglass was initially established to operationalise Rubrik Agent Cloud for Anthropic’s Claude Code. Its capabilities include runtime behavioural guardrails, prompt-context protection and Agent Rewind, which is designed to reverse unintended actions.

The addition of Code Guardian extends the initiative from governing agent activity to testing the code repositories that underpin software development. Together, the offerings are intended to address different stages of AI-assisted engineering: controlling agent behaviour and identifying security risks in code before deployment.

Rubrik’s broader approach to agentic cyber resilience also encompasses identity, observability and recovery. Its GSI Summit presentation describes a progression from traditional data protection and cyber recovery towards AI resilience and agentic resilience, with capabilities spanning identity governance, monitoring, recovery and controls over agent actions.

For enterprises adopting AI-assisted software development, the distinction matters. Securing an AI coding workflow involves not only monitoring what an agent does, but also assessing whether the code it helps produce introduces exploitable weaknesses.

Expanding partner capabilities

The expanded Project Hourglass alliance is intended to help participating systems integrators bring the security capabilities to enterprise customers. Rubrik said the programme provides joint go-to-market resources, dedicated technical certification tracks and direct access to engineering teams to support customer deployments.

The partners also bring their own security and resilience practices to the initiative.

AHEAD said the collaboration would help customers test and validate code in a safe environment before release, while retaining Rubrik’s recovery capabilities. WWT pointed to its Advanced Technology Center, which it uses to test and validate security solutions, as a foundation for integrating isolated threat testing into its work with customers.

Trace3 said it was using Rubrik Agent Cloud internally to support its own agentic AI initiatives and intended to bring that experience to customers through its resilience and AI risk and governance practices.

“Engineering teams are turning to AI models to accelerate software delivery, but speed cannot compromise security or architectural integrity,” said Alok Agrawal, Chief Solutions Officer at Rubrik.

The expanded alliance places greater emphasis on integrating code testing, agent controls and recovery into enterprise AI deployments. However, Code Guardian remains in private preview, and its wider availability and capabilities are yet to be established.

For systems integrators, the step will be translating these capabilities into customer deployments as enterprises move from experimenting with AI coding tools to incorporating autonomous agents into software engineering workflows.