Delinea has joined Anthropic’s Project Glasswing and is testing Claude Mythos 5.1 against its own privileged-access software, beginning with code that stores, brokers and rotates credentials.
The defensive security work covers vaulting logic, secret storage and rotation, key management and cryptographic implementations. It also includes the connection, credential-injection and proxy code used to broker sessions between users or AI agents and the systems they access.
Delinea will test policy evaluation and just-in-time authorization, which determines whether an action is permitted when it is requested rather than relying on standing privileges. The company is looking for weaknesses in how access is granted, controlled or removed, including combinations of behavior that developers did not intend.
Chief Information Security Officer Pierre Mouallem said the model’s access will be scoped, temporary and logged. Testing takes place in an isolated environment against Delinea code and a test deployment. Customer data, credentials, tenants and environments are excluded, and the company says it is not adding Mythos to its customer products.
Findings will enter Delinea’s existing product security process for validation, triage and remediation. Recurring vulnerability patterns will be incorporated into secure coding standards, pre-merge checks and test coverage. Model findings will follow the same established handling as vulnerabilities reported by human researchers, including issues affecting products that have already shipped.
CEO Art Gilliland said AI-assisted vulnerability discovery is changing the expectations placed on security vendors. He described the company’s participation as a way to challenge its own design assumptions and identify problems before attackers do.
Delinea has separately developed controls for AI and machine identities, including an integration with Yubico that binds human approval to high-risk AI agent actions. Its Cyera integration connects privileged identities with sensitive-data access to inform risk assessments. Glasswing addresses security testing of the code behind access controls. The model-assisted review supplements the company’s existing security reviews and independent penetration testing before products ship.
The company plans to share validated findings and remediation patterns with the Glasswing cohort. Issues involving third-party or open-source components will follow coordinated vulnerability disclosure timelines, while vulnerabilities affecting Delinea products will be communicated through its Security Advisories site and established customer security channels.
Sources: Delinea Release, Delinea
–
By the ID Tech Editorial Team
