Delinea, the identity security platform that controls what AI agents, humans and machines can do once they have access, has joined Project Glasswing, Anthropic’s initiative to secure the world’s most critical software using frontier AI. Delinea is testing Claude Mythos 5.1 for defensive cybersecurity work, beginning with its own code that stores, brokers, and rotates privileged credentials.
Project Glasswing brings together organizations whose software supports critical infrastructure and could have catastrophic results if successfully attacked. Identity security belongs in that category, because a flaw in it can expose every system it governs access to. Delinea’s software already undergoes rigorous security review and adversarial testing, and Project Glasswing adds a frontier AI model to that process, applied to Delinea’s own code.
“AI is making it much easier to find weaknesses in software, and that changes what customers should expect from security companies,” said Art Gilliland, CEO at Delinea. “We joined Project Glasswing to use the best tools available to attack our own assumptions and find problems before someone else does.”
Delinea’s application of Mythos to its own systems covers:
- Credential and secrets handling. Vaulting logic, secret storage and rotation, key management, and cryptographic implementation.
- Session brokering and privileged access paths. The connection, injection, and proxy code that stands between a user or agent and a target system.
- Authorization enforcement. Policy evaluation and just-in-time authorization paths, where a logic flaw can be as consequential as a memory-safety vulnerability.
- Feedback into the SDLC. Findings are triaged and remediated through Delinea’s existing product security process, and recurring patterns become secure coding standards, pre-merge checks, and test coverage so each fix compounds in later releases.
“We’re treating Mythos like any other privileged identity: its access is scoped, temporary and logged,” said Pierre Mouallem, Chief Information Security Officer at Delinea. “It runs against our code in an isolated environment with no customer data in scope. Anything it finds enters the same product security and disclosure process as a human-reported vulnerability.”
Delinea will share validated findings and remediation patterns with the Glasswing cohort and follow coordinated vulnerability disclosure timelines for issues affecting third-party or open-source components. Vulnerabilities affecting Delinea products will be disclosed through Delinea’s Security Advisories site.
