Visa Anthropic’s Claude Mythos focused on the infrastructure behind billions of daily transactions, a network that spans more than 200 countries and territories, transfers funds in nearly 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.
The model combined small vulnerabilities in the stack into working exploit chains that would traditionally only be exposed in penetration testing. Rajat Taneja, Visa’s president of technology, is along for the ride VB Transform 2026 What followed was presented to the audience, including why Visa is releasing the entire hunting harness as open source, and why the company is abandoning traditional remediation metrics for a measurement invented by its own team.
Taneja has led technology strategy, product engineering and global infrastructure at Visa since 2019, after joining the company from Electronic Arts in 2013, where he served as CTO after 15 years at Microsoft. It is co-authored with Visa Chief Information Security Officer Subra Kumaraswamy June 10 blog post announces its release Visa Vulnerability Agency Trailer on GitHub as a reference application that any security team can test, adapt and extend. Visa also published technical white paper 12 non-negotiable architectural practices for architecture details, lessons learned, and critical infrastructure.
Confidence built on pessimism and paranoia
Taneja led the way with a score that made Visa a target worth defending obsessively. At the scale of global payments, trust is built through what he calls pessimism and paranoia, by assuming failure and designing around it before it happens. The network has been hardened over many years through a zero-trust architecture, layered defenses, and highly automated security operations built for the scale and reliability of global payment demand.
So when Anthropic invited the organizations behind mission-critical software to test Mythos as part of Project Glasswing, Visa said yes. Glasswing participants have collectively identified more than 10,000 high or critical vulnerabilities. the first month of the test According to Anthropic, among software that supports industry-wide critical systems. Anthropic’s own conclusion created a bottleneck in the speed of verification, disclosure and patching after discovery. Visa joined to test decades of hardening at the speed of artificial intelligence and see if advanced models can take their defenses even further.
What Mythos showed on Visa
In the Visa environment, Mythos demonstrated system-wide, context-aware analysis, uncovering vulnerabilities hidden deep in the stack and flagging problems that become more serious when chained together. Some of the findings were of critical severity, and Visa confirms its zero-trust controls, network segmentation and layered security by breaking the chain before any external actor can act.
Taneja said that confirmation was important, but the epiphany that followed was even more important. "In a world of agent attacks, defense must also be an agent," he said. Even at a company that has invested in defense in depth for decades, the model revealed assumptions the team needed to rethink. Traditional SAST tools have their place as a first pass against known vulnerability patterns, Visa’s white paper notes, but pattern matching alone cannot track an adversary who wrangles exploit chains that live between logic, data flows and signatures.
Not a scanner, but a trailer
Visa’s answer was not another monolithic scanner. The team built the Visa Vulnerability Agent Harness, now in its fifth generation, as a managed pipeline that guides boundary AI models through structured security tasks while applying deterministic controls, policy gates, and human oversight at each stage. Taneja went through design philosophy. The harness works in four phases and eleven stages, from code acceptance and threat modeling through deep dive verification, exploitation chain synthesis, and finally remediation and fix verification.
According to the project’s own documentation, three design options help you find quality. Threat modeling works before analysis to focus on the attack surface rather than blindly scanning everything, multi-agent deterministic polling requires convergence between independent chains of reasoning before a finding can be advanced, and structured triage artifacts compress the life cycle that discoverers can actually deploy. The charge is a hot-running pipeline by default. A simple scan in the submitted profile performs all eleven steps and, if the operator does not stop it during detection, edits the source files in the target repository in debug mode, applying candidate patches.
The trailer is multi-modal in design. The LLM abstraction layer allows Visa providers to change or merge without changing the control plane, and the open source version works with Anthropic Claude, OpenAI-compliant models, or a mix. The repo documentation is candid about the exception. Applying a fix only requires file editing tools exposed by Anthropic backends, so the remediation and validation phases currently require Anthropic models for full functionality, and the OpenAI-compliant model in these roles is limited to report output only. VentureBeat’s Q2 2026 Pulse research, presented earlier at the conference, reinforces why provider flexibility matters. Among the businesses that participated in the survey 82% rely on the provider’s local controls as their primary layer of securityand 59% plan to adopt or change agent security tools within the year. The controls adopted last year are already becoming the controls they plan to replace.
Average Time to Adapt replaces the old metrics
Finding vulnerabilities is no longer the difficult part, claimed Taneja. The real challenge is how quickly the team can confirm that the problem is actually exploitable, fix it, and prove that the attack path is closed, rather than showing that a patch has been applied. Visa calls it Average Time to Match, and the white paper tracks it in three dimensions. Inventory freshness measures an organization’s current and complete view of its code, configuration, and runtime deployments. Usable paths per release count how many end-to-end attack chains remain possible, not how many finds are closed after each release. Validation cycle time tracks how long it takes to develop repeatable, evidence-based proof that a fix works and continues to work in production.
This difference is significant because older measures such as average time to detect and raw CVE closure counts may look better on paper, while actual exposure continues to grow beneath them. An organization can shut down hundreds of finds per month, leaving existing exploit chains open if no one tests whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters, and the white paper draws on CISA’s Known Exploitable Vulnerabilities data to develop a prioritization issue, noting that less than 1% of CVEs are actively exploited. Visa’s SSDLC policy now stipulates that the entire exploitable path will be deployed in production and requires that it be patched before code can be promoted.
Supply chain risk accelerates under AI
When Taneja approached suppliers, the conversation moved beyond Visa’s own perimeter. A well-defended enterprise is exposed through weak vendors and weak open source components, the white paper warns, making Visa’s AI-specific security posture a non-negotiable measure of vendor due diligence with ongoing vulnerability testing, live software materials, and MTTA base expectations across the technology stack.
Visa has also joined Project Lightwell A $5 billion IBM and Red Hat initiative Working with financial institutions including Bank of America, JPMorganChase, Goldman Sachs and Mastercard to harden widely used open source components through AI-based verification and coordinated patching. The commitment extends the same logic upwards, as the MTTA clock does not pause at the perimeter of any company.
When agents start buying things
Securing agent trade is Visa’s next challenge. Taneja described a future where AI agents conduct transactions on behalf of consumers and businesses, and said Visa is building the trust framework, personality level and agent training assessment that merchants will need so that agents can safely complete transactions. Behind this work is the Visa Payment Threat Lab, a simulation environment where real fraud scenarios are replayed against the authorization rules, limits and configurations that Visa actually operates, and which presents AI-enabled failure modes as targeted hardening recommendations.
The problem of identity is not theoretical. VentureBeat’s Pulse research found that 69% of enterprises already exchange credentials in their agent deployments, and companies with shared credentials report 63.5% of security incidents or breaches, versus 40.9% where each agent has its own coverage. Visa’s white paper lists this gap directly "AI agents are personalities" Among the 12 non-negotiable practices that require comprehensive permissions, least-privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies the system.
Three priorities for defenders
Taneja said Visa is organizing its defense strategy around three priorities. Leave security to the left and replace high-risk, low-support components before material impact before exploitable flaws are engineered into production. Third, Visa is the heaviest lifter at scale, refactoring defenses to operate autonomously under human control, so detection, verification and response continue rapidly as threats grow in volume and the models behind attacks improve.
None of these require a payment network budget to begin with. The trailer sits on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard, not a procurement cycle, and the white paper looks at the architecture’s 12 non-discussion experience map security teams are already working. The result of the visa itself is read as the deadline. The paper claims that the opening to outrun attackers at car speed still exists and won’t stay open.
