Visa used Mythos to hunt down bugs in its payments network, then open-sourced the harnesses that made it possible.

Visa directed Anthropic’s Claude Mythos to the infrastructure behind billions of daily transactions, a network that includes more than 200 countries and territories, transfers money in about 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.

The model sewed small vulnerabilities deep in the stack into exploit chains that would normally only appear late in a penetration test. Rajat Taneja, Visa’s president of technology, took the VB Transform 2026 audience on what happened next, including why Visa released the harness that governs the entire hunt as open source and why the company ditched traditional maintenance metrics for the measure its team developed.

Taneja has run technology strategy, product engineering, and global infrastructure at Visa since 2019, after joining the company in 2013 from Electronic Arts, where he served as CTO after 15 years at Microsoft. He co-authored, with Visa chief information security officer Subra Kumaraswamy, a June 10 blog post announcing the release of the Visa Vulnerability Agentic Harness on GitHub as a reference implementation that any security team can test, adapt, and extend. Visa also published a technical white paper detailing architecture, lessons learned, and 12 negotiable practices for critical infrastructure architecture.

Trust is built on pessimism and paranoia

Taneja led with the arithmetic that made Visa a target to be guarded against. Confidence in the world’s payments scale is developed from what he calls pessimism and paranoia, by anticipating failure and designing around it before failure occurs. The network has been hardened over the years thanks to trusted architecture, layered security, and automated security functions built for the scale and reliability of global payments demand.

So when Anthropic invited organizations behind critical software to test Mythos under Project Glasswing, Visa said yes. Glasswing’s partners collectively identified more than 10,000 high or critical vulnerabilities in the first month of testing across software that supports critical systems across the industry, according to Anthropic. Anthropic’s own conclusion has put a bottleneck behind discovery, verification, disclosure, and speed of amendment. Visa joined the decades-old test of AI speed and learned where advanced models can advance its defenses.

What the Mythos means to Visa

Within the Visa environment, Mythos has demonstrated system-wide, context-aware analysis of vulnerabilities that appear buried deep in the stack and flagging issues that grow more critical when tied together, with findings clean enough that engineering teams can act on them without getting into the noise. Some of the findings carry serious risk ratings, and Visa credits Visa for including its zero-trust controls, network isolation, and layered defenses by breaking the chain before any outside actor can act.

That confirmation is important, Taneja says, but the epiphany that followed is even more important. "In the world of agent attacks, the defense must also be the agency," he said. Even for a company that has invested decades in defense-in-depth, the model has revealed perceptions that the team has been underperforming that need to be reconsidered. Traditional SAST tools retain their place as a starting point for addressing known vulnerability patterns, the Visa white paper notes, but pattern matching alone cannot follow a logically thinking adversary, data flows, and exploit chains that reside between signatures.

The harness, not the scanner

Visa’s response was not another monolithic scanner. The team is building the Visa Vulnerability Agentic Harness, now in its fifth generation, as a managed pipeline that guides AI models at the edge through structured security operations while enforcing prescriptive controls, policy gates, and human oversight at all stages. Taneja went with a design philosophy. The harness works across four stages and eleven stages, from coding and threat modeling through deep verification, exploit chain integration, and finally maintenance and verification of repairs.

Three design options lead to quality, according to the project’s own documentation. Threat modeling begins before analysis to focus on the attack surface instead of blindly scanning everything, multi-agent deterministic polling requires convergence across independent chains of thought before making progress, and structured artifacts that have a life cycle from detection to output that can be deployed by developers. Payment is an automated pipeline. The transparent scan in the submitted profile runs all eleven stages and edits the source files in the target directory in repair mode, using candidate patches unless the operator stops them on discovery.

The harness has many models in terms of design. The dense layer of LLM allows Visa to change or merge providers without changing the control plane, and the open source version works with Anthropic Claude, models compatible with OpenAI, or mix. The repo documentation is clear about this exception. Using debugging requires tools to edit files that Anthropic only exposes, so the debugging and validation phases currently require Anthropic models to be fully functional, and the model compatible with OpenAI in those roles is limited to report output only. VentureBeat’s Q2 2026 Pulse study, presented earlier at the conference, reinforces why that provider flexibility is important. Among businesses surveyed, 82% rely on traditional vendor controls as their primary security layer, and 59% plan to implement or replace agent security tools within a year. The control companies that were accepted last year are already the controls that are planning to change them.

Average Adaptation Time replaces inheritance metrics

Finding weaknesses is no longer the hard part, Taneja argued. The real challenge is how quickly the team can confirm that the problem is actually exploitable, fix it, and ensure that the attack path is closed rather than simply applying a patch. Visa calls this Mean Time to Adapt, and the white paper tracks it in three dimensions. Inventory freshness measures how current and complete an organization’s view of code, configuration, and runtime usage is. The methods that can be used for each release count how many end-to-end attack chains are still possible after each release, not just how many were found to be closed. Validation cycle time tracks how long it takes to generate repeatable, evidence-based proof that a fix works and stays in production.

That distinction is important because legacy measures like direct time to detection and raw CVE closure statistics can look better on paper while actual exposure continues to grow beneath them. An organization can block hundreds of exploits per month and leave exploit chains open if no one checks that the patches actually break the attack. The MTTA forces parties to measure a significant effect, and the white paper relies on CISA’s Known Vulnerable Exploitation data to make a significant case, noting that less than 1% of CVEs are ever exploited. Visa’s SSDLC policy now assumes every executable will be used in production and requires it to be fixed before the code can be promoted.

Supply chain risk is accelerating under AI

The conversation moved to the Visa circuit itself when Taneja turned to suppliers. A well-protected business is always exposed to weak vendors and weak open source components, the white paper warns, so Visa makes the AI-specific security situation a non-negotiable aspect of supplier due diligence, expected continuous vulnerability verification, live software credits for building materials, and MTTA foundations for the stake.

Visa has also joined Project Lightwell, a $5 billion IBM and Red Hat initiative to harden open source components widely used with AI-driven authentication and integration, alongside financial institutions including Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends the same idea upstream, because MTTA’s watch does not rest on any one company’s perimeter.

When agents start buying things

Protecting agent transactions is the next problem for Visa. Taneja described a future where AI agents work for consumers and businesses, and said Visa is building a trust framework, identity layer, and agent readiness to get the points merchants will need before agents can complete transactions securely. Behind that work sits the Visa Payment Threats Lab, a simulation environment where real-world fraud scenarios are replicated against Visa’s real-world authorization rules, restrictions, and configurations, to reveal AI-enabled failure modes as targeted resilience recommendations.

The identity challenge is not a theory. VentureBeat’s Pulse study found that 69% of businesses already do data sharing at some point in their agent deployments, and companies with shared data report security incidents or near misses at a rate of 63.5%, compared to 40.9% when each agent has its own identity. Visa’s white paper address has a specific gap, in the list "AI agents are not identities" among its 12 negotiable practices that require broad permissions, the use of least privileges, full audit trails, and inclusion in IAM governance of all agents that call an API, read data, or modify the system.

Three important things for defenders

Visa organizes its defense strategy around three key elements, Taneja said. Shift protection to the left until exploitable errors are designed before they reach production, and instead of high-risk components, which can be partially supported before they turn into critical exposures. The third most difficult lift on Visa’s scale is defenses that evolve to operate autonomously under human control so that detection, verification, and response continue as threat volume grows and post-attack models evolve.

None of them require a payment network budget to get started. The harness resides on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard rather than a procurement cycle, and a map of 12 non-negotiable white paper processes that review security teams have already worked on. Visa’s own conclusion reads like a deadline. The opening to bypass machine speed attackers still exists, the paper argues, and it won’t stay open.