Rubrik, the Security and AI Operations Company, has unveiled Rubrik Code Guardian, a custom harness built on Anthropic’s Claude Mythos 5 that red-teams a customer’s code using an air-gapped copy of their repository.

The service is designed to uncover and prioritise the kind of multi-step vulnerability chains an attacker would actually exploit, validate each one for real exploitability, and turn confirmed critical issues into tracked remediation work — all without touching a live repository or production environment.

“Rubrik is one of the partners we are working with to put Claude Mythos 5’s cyber capabilities in defenders’ hands, so they can find and validate attack paths before attackers do,” said Michael Moore, Cybersecurity lead at Anthropic. “Rubrik will use the model to test code faster and at far greater scale, and to bring cyber resilience up to the speed of AI.”

Testing code at machine speed

Rubrik built Code Guardian in response to the same frontier AI capabilities it says attackers are starting to turn against enterprises.

“Frontier models are advancing at a fast pace. In the wrong hands, these models can be used to discover, chain, and exploit vulnerabilities at machine speed,” said Arvind Nithrakashyap, Co-Founder and Chief Technology Officer at Rubrik. “To move just as fast, we are using frontier AI to scale vulnerability detection faster than our traditional code scanning tools. We took Anthropic’s powerful model and built a Rubrik software harness to test on our code. We are using that experience and success now to give customers access to the harness, with a secure, isolated environment, which means we can run analysis of their code away from live repository and production systems.”

What Code Guardian does

Rubrik outlines five core capabilities behind the product:

• Red-team customer code, safely — Claude Mythos 5 runs through Rubrik’s custom security harness against a secure clone of an immutable, air-gapped copy, never the live repository or production environment.
• Attack chains, not alerts — reasons across files, services, authentication patterns and cloud boundaries to surface chained vulnerabilities that conventional scanning tools miss.
• Validated findings, prioritised by business criticality — confirms attack chains for real exploitability before surfacing them, ranked by exploitability, blast radius and business criticality.
• Accelerated remediation — pushes confirmed critical issues into developer workflows through Jira or GitHub issues, with file-level remediation guidance.
• Built-in code resilience — keeps recovery workflows in place so organisations can restore a known-good codebase after a security event or bad build.

Rubrik Code Guardian is currently accepting select design partners for private preview.