Visa turned Anthropic’s Claude Mythos loose on the infrastructure that processes billions of daily transactions, and the model did something that traditional security tools had not been able to do at scale: it stitched minor weaknesses buried deep in the software stack into working exploit chains \u2014 chains that typically surface only during the final stages of penetration testing. The result was not just a set of fixed vulnerabilities, but a fundamental shift in how Visa thinks about measuring security effectiveness, and the release of an open-source framework that any organization can now use to run the same kind of AI-driven hunt.<\/p>\n
Rajat Taneja, Visa’s president of technology, presented the results and the strategic thinking behind them at VB Transform 2026, walking through why the company abandoned conventional remediation metrics for a measurement its team invented, and why it chose to publish the entire governance harness on GitHub as a reference implementation. The announcement, co-authored with Visa chief information security officer Subra Kumaraswamy, included a detailed technical white paper that lays out 12 non-negotiable architectural practices for critical infrastructure security in the age of agentic AI.<\/p>\n
Trust at the scale of global payments is engineered through what Taneja called pessimism and paranoia \u2014 by assuming failure and designing around it before failure arrives. Visa’s network spans more than 200 countries and territories, moves money in roughly 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations. The network has been hardened over many years through zero-trust architecture, layered defenses, and highly automated security operations built for the scale and reliability that global payments demand.<\/p>\n
So when Anthropic invited organizations behind critical software to test its Mythos model under Project Glasswing, Visa was an early and willing participant. The premise was straightforward: see whether a frontier AI model could find vulnerabilities that decades of traditional security tooling had missed, and do so at a speed that matters in a world where attacks are increasingly automated. The early results were striking. Glasswing participants collectively identified more than 10,000 high- or critical-severity vulnerabilities in the first month of testing across software underpinning critical systems industry-wide, according to Anthropic. The company’s own conclusion placed the bottleneck not in discovery, but in verification, disclosure, and patching speed.<\/p>\n
Inside Visa’s own infrastructure, Mythos demonstrated what the team describes as system-wide, context-aware analysis. It surfaced vulnerabilities buried deep in the stack, and more importantly, it flagged issues that grow more serious when chained together. The findings were clean enough that engineering teams could act on them without wading through the noise that typically accompanies automated scanning output. Some findings carried critical severity ratings. Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any external actor could have exploited the vulnerabilities in a real attack.<\/p>\n
That confirmation mattered, Taneja said, but the epiphany that followed mattered more. “In a world of agentic attacks, defense also has to be agentic,” he told the audience. Even at a company that has invested decades in defense-in-depth, the model revealed assumptions the team had been operating under that needed rethinking. Traditional static application security testing tools keep their place as a first pass against known vulnerability patterns, the white paper notes, but pattern matching alone cannot follow an adversary who reasons through logic, data flow, and the exploit chains that live between the signatures.<\/p>\n
Visa’s response was not to build another monolithic scanner. The team created the Visa Vulnerability Agentic Harness, now in its fifth generation of internal development, as a governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. The harness operates across four phases and eleven stages, from code ingestion and threat modeling through deep-dive verification, exploit chain synthesis, and finally remediation and fix validation.<\/p>\n
Three design choices drive the quality of the findings. First, threat modeling runs before analysis to focus on the attack surface rather than scanning everything blindly. Second, multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances. Third, structured triage artifacts compress the lifecycle from discovery to a result that developers can actually ship. The payoff is a pipeline that runs hot by default. A plain scan in the shipped profile runs all eleven stages and edits source files in the target repository in fix mode, applying candidate patches unless the operator stops it at the detection stage.<\/p>\n
Multi-model by design, the harness includes an LLM abstraction layer that lets Visa swap or combine providers without changing the control plane. The open-source version works with Anthropic Claude, OpenAI-compatible models, or a mix. The documentation is candid about one limitation: applying a fix requires the file-editing tools that only the Anthropic backends expose, so the remediation and validation stages currently require Anthropic models for full functionality. An OpenAI-compatible model in those roles is limited to report-only output.<\/p>\n
That provider flexibility matters more than it might have a year ago. VentureBeat’s Q2 2026 Pulse research, presented earlier at the same conference, found that 82% of enterprises rely on provider-native controls as their primary security layer, and 59% plan to adopt or switch agent security tooling within the year. The controls enterprises adopted last year are already becoming the controls they plan to replace.<\/p>\n
Finding vulnerabilities is no longer the hard part, Taneja argued. The real challenge is how quickly a team can confirm that an issue is truly exploitable, fix it, and prove that the attack path is closed \u2014 rather than just showing that a patch was applied. Visa calls this Mean Time to Adapt, and the white paper tracks it along three dimensions.<\/p>\n
Inventory freshness measures how current and complete the organization’s view is of code, configuration, and runtime deployment. Exploitable paths per release counts how many end-to-end attack chains remain possible after each release, not just how many findings were closed. Validation cycle time tracks how long it takes to produce repeatable, evidence-backed proof that a fix works and stays working in production.<\/p>\n
This distinction matters because legacy measures such as mean time to detect and raw CVE closure counts can look better on paper while actual exposure keeps growing underneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if nobody tested whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters. The white paper leans on CISA<\/a> Known Exploited Vulnerabilities data to make the prioritization case, noting that fewer than 1% of CVEs are ever actively exploited. Visa’s own secure software development lifecycle policy now assumes that every exploitable path will be exercised in production and requires it to be remediated before code is promoted.<\/p>\n The Visa Vulnerability Agentic Harness is an open-source, governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. It operates across four phases \u2014 code ingestion and threat modeling, deep-dive verification, exploit chain synthesis, and remediation and fix validation \u2014 and eleven stages total. The harness uses multi-agent deterministic voting, requiring convergence across independent reasoning chains before a finding advances, and it produces structured triage artifacts that compress the lifecycle from discovery to deployable fix. The open-source version is available on GitHub and works with Anthropic Claude, OpenAI-compatible models, or a mix, though full remediation functionality currently requires Anthropic models.<\/p>\n The conversation moved past Visa’s own perimeter when Taneja turned to suppliers. A well-defended enterprise stays exposed through weak vendors and weak open-source components, the white paper warns. Visa is making AI-specific security posture a non-negotiable dimension of supplier due diligence, with expectations for continuous vulnerability validation, living software bills of materials, and MTTA baselines across its technology stack.<\/p>\n Visa has also joined Project Lightwell, the $5 billion IBM and Red Hat initiative to harden widely used open-source components through AI-driven validation and coordinated patching. The project includes financial institutions such as Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends the same logic upstream, because the MTTA clock does not pause at any single company’s perimeter.<\/p>\n Securing agentic commerce is Visa’s next problem. Taneja described a future where AI agents<\/a> transact on behalf of consumers and enterprises, and said Visa is building the trust framework, identity layer, and agent readiness scoring that merchants will need before agents can safely complete transactions. Behind that work sits the Visa Payment Threats Lab, a simulation environment where real fraud scenarios get replayed against the authorization rules, thresholds, and configurations that Visa actually runs, to surface AI-enabled failure modes as targeted hardening recommendations.<\/p>\nWhat is the Visa Vulnerability Agentic Harness and how does it work?<\/h2>\n
Supply chain risk accelerates under AI-driven validation<\/h2>\n
When agents start buying things: securing agentic commerce<\/h2>\n