Delinea Joins Anthropic’s Project Glasswing to Use AI Against Its Own Security Code

Identity security company Delinea has joined Anthropic’s Project Glasswing, using Anthropic’s frontier AI model Claude Mythos 5.1 to test and identify vulnerabilities in its own software, including code responsible for credential vaulting, secrets management and privileged session brokering.

The initiative will apply AI-driven defensive cybersecurity techniques to Delinea’s own systems, with the company focusing on code paths where vulnerabilities could expose privileged access across the systems it governs.

“AI is making it much easier to find weaknesses in software, and that changes what customers should expect from security companies,” said Art Gilliland, CEO at Delinea. “We joined Project Glasswing to use the best tools available to attack our own assumptions and find problems before someone else does.”

As part of Project Glasswing, Delinea will use Mythos to examine several security-critical areas of its software. These include credential and secrets handling, covering vaulting logic, secret storage and rotation, key management and cryptographic implementations. The model will also examine session brokering and privileged access paths, including the connection, injection and proxy code that sits between users or AI agents and target systems.

The assessment will also cover authorisation enforcement, including policy evaluation and just-in-time authorisation paths, where flaws in access-control logic can potentially be as consequential as memory-safety vulnerabilities. Findings from the AI-led testing will be fed into 

Delinea’s existing software development lifecycle, where they will be triaged and remediated. The company said it could then incorporate recurring vulnerability patterns into secure coding standards, pre-merge checks and test coverage.

Project Glasswing brings together organisations whose software supports critical infrastructure and where successful attacks could have significant consequences. Delinea said identity security belongs in this category because vulnerabilities in identity systems could potentially expose the systems and resources they govern access to.

Delinea said it will treat the AI model’s access to its code as a privileged identity, with access scoped, temporary and logged. Mythos will operate in an isolated environment, with no customer data included in its scope.

“We’re treating Mythos like any other privileged identity: its access is scoped, temporary and logged,” said Pierre Mouallem, Chief Information Security Officer at Delinea. “It runs against our code in an isolated environment with no customer data in scope. Anything it finds enters the same product security and disclosure process as a human-reported vulnerability.”

Delinea said validated findings and remediation patterns will be shared with the Project Glasswing cohort. For vulnerabilities affecting third-party or open-source components, the company will follow coordinated vulnerability disclosure timelines. Vulnerabilities affecting Delinea products will be disclosed through the company’s Security Advisories process.

The partnership comes as AI-assisted vulnerability discovery becomes increasingly relevant to cybersecurity, potentially allowing both attackers and defenders to identify software weaknesses faster and at greater scale. 

For Delinea, the Glasswing initiative aims to use those capabilities defensively by applying them directly to the code underpinning privileged identity and access controls.