Visa pointed Anthropic’s Claude Mythos to the infrastructure behind billions of daily transactions, a network that spans more than 200 countries and territories, moves money in approximately 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.
The model stitched together minor weaknesses deep in the stack into exploit chains that traditionally would have emerged only at the end of penetration testing. Rajat Taneja, president of technology at Visa, walked the VB Transformation 2026 hearing about what came next, including why Visa released the harness that governed the entire search as open source and why the company abandoned traditional remediation metrics for a measurement his team invented.
Taneja has led technology strategy, product engineering and global infrastructure at Visa since 2019, after joining the company in 2013 from Electronic Arts, where he served as chief technology officer after 15 years at Microsoft. He co-authored, along with Visa Chief Information Security Officer Subra Kumaraswamy, the June 10 blog post announcing the release of Agentic Harness Visa Vulnerability on GitHub as a reference implementation that any security team can inspect, adapt and extend. Visa also published a technical document detailing the architecture, lessons learned, and 12 non-negotiable architectural practices for critical infrastructure.
Trust built on pessimism and paranoia
Taneja led with the arithmetic that makes Visa a target worth obsessively defending. Trust at the global payments scale is built through what he called pessimism and paranoia, by assuming failure and designing around it before failure arrives. The network has been hardened over many years through a zero-trust architecture, layered defenses, and highly automated security operations designed for the scale and reliability that global payments demand.
So when Anthropic invited the organizations behind the critical software to test Mythos under Project Glasswing, Visa said yes. Glasswing participants collectively identified more than 10,000 high or critical severity vulnerabilities in the first month of trial in all software that underpins critical systems across the industry, according to Anthropic. Anthropic’s own conclusion placed the bottleneck after discovery, at verification, disclosure, and speed of patching. Visa teamed up to test decades of strengthening AI at speed and learn where advanced models could further boost its defenses.
What Mythos showed at Visa
Within the Visa environment, Mythos demonstrated system-wide contextual analysis, surfacing vulnerabilities buried deep in the stack and pointing out issues that become more serious when chained together, with findings clear enough that engineering teams could act on them without having to cut through the noise. Some findings received critical severity ratings, and Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any outside actors could have acted.
That confirmation was important, Taneja said, but the epiphany that followed was more important. "In a world of agent attacks, the defense also has to be agent," said. Even at a company that has invested decades in defense in depth, the model revealed assumptions the team had been operating under that needed rethinking. Traditional SAST tools retain their place as a first step against known vulnerability patterns, the Visa whitepaper notes, but pattern matching alone cannot follow an adversary who reasons through the logic, data flow, and exploit chains that live between signatures.
A harness, not a scanner
Visa’s response was not another monolithic scanner. The team created the Visa Vulnerability Agentic Harness, now in its fifth generation, as a governed channel that directs edge AI models through structured security tasks while applying deterministic controls, policy gates, and human oversight at every stage. Taneja reviewed the design philosophy. The harness operates in four phases and eleven stages, from code ingestion and threat modeling to deep verification, exploit chain synthesis, and finally remediation and fix validation.
Three design options drive the search for quality, according to the project documentation itself. Threat modeling runs before analysis to focus on the attack surface rather than blindly scanning everything, deterministic multi-agent voting requires convergence between independent chains of reasoning before a finding is advanced, and structured classification artifacts compress the lifecycle from discovery to a result that developers can actually submit. The reward is a pipeline that is activated by default. A simple scan on the submitted profile runs all eleven stages and edits the source files in the target repository in repair mode, applying candidate patches unless stopped by the operator at detection time.
The harness is multi-model by design. An LLM abstraction layer allows Visa to swap or combine providers without changing the control plane, and the open source version works with Anthropic Claude, OpenAI-compatible models, or a combination. The repository documentation is upfront about the exception. Applying a solution requires file editing tools that only expose Anthropic backends, so the remediation and validation stages currently require Anthropic models for full functionality, and an OpenAI-compatible model in those roles is limited to report-only results. VentureBeat’s Pulse research for Q2 2026, presented earlier at the conference, reinforces why supplier flexibility matters. Among the companies surveyed, 82% rely on native vendor controls as their primary security layer.and 59% plan to adopt or change agent security tools within the year. The controls that companies adopted last year are already becoming the controls they plan to replace.
Mean adaptation time replaces legacy metrics
Finding vulnerabilities is no longer the difficult part, Taneja argued. The real challenge is how quickly a team can confirm that an issue is actually exploitable, fix it, and demonstrate that the attack path is closed rather than simply showing that a patch was applied. Visa calls this mean time to adapt, and the whitepaper tracks it in three dimensions. Inventory update measures how up-to-date and complete the organization’s view of code, configuration, and runtime deployment is. Exploitable paths per release count how many end-to-end attack chains remain possible after each release, not just how many finds were closed. Validation cycle time tracks how long it takes to produce repeatable tests backed by evidence that a solution works and stays working in production.
That distinction is important because legacy measures, such as mean time to detection and raw CVE closure counts, may look better on paper, while actual exposure continues to grow beneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if no one tests whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters, and the whitepaper draws on CISA’s known exploited vulnerability data to justify prioritization, noting that less than 1% of CVEs are actively exploited. Visa’s SSDLC policy now assumes that all exploitable paths will be exercised in production and requires that they be remediated before promoting code.
Supply chain risk accelerates with AI
The conversation went beyond Visa when Taneja turned to the suppliers. A well-defended enterprise remains exposed through weak vendors and weak open source components, the whitepaper warns, so Visa is making AI-specific security posture a non-negotiable dimension of vendor due diligence, with expectations of ongoing vulnerability validation, live software BOMs, and MTTA baselines across its technology stack.
Visa has also joined Project Lightwell, the IBM and Red Hat initiative for 5 billion dollars to strengthen widely used open source components through AI-powered validation and coordinated patching, alongside financial institutions such as Bank of America, JPMorganChase, Goldman Sachs and Mastercard. The commitment extends the same logic upwards, because the MTTA clock does not stop at the perimeter of any company.
When agents start buying things.
Securing agent trade is Visa’s next problem. Taneja described a future in which AI agents will conduct transactions on behalf of consumers and businesses, and said Visa is building the trust framework, identity layer and agent readiness score that merchants will need before agents can securely complete transactions. Behind that work is the Visa Payment Threat Lab, a simulation environment where real fraud scenarios are played against the authorization rules, thresholds and settings that Visa actually executes, to display AI-enabled failure modes as specific reinforcement recommendations.
The challenge of identity is not theoretical. VentureBeat’s Pulse research found that 69% of companies already share credentials somewhere in their agent deployments, and companies with shared credentials report security incidents or near misses at a rate of 63.5%, compared to 40.9% where each agent has its own scope identity. Visa’s white paper addresses that gap directly, listing "AI agents are identities" among its 12 non-negotiable practices that require scoped permissions, least privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies a system.
Three priorities for defenders
Visa is organizing its defensive strategy around three priorities, Taneja said. Shift security to the left until exploitable flaws are designed out before they reach production, and replace high-risk, undersupported components before they become material exposures. The third is Visa’s biggest scale push, refactoring defenses to run autonomously under human governance, so that detection, validation and response keep pace as threat volume grows and the models behind attacks improve.
None of this requires the budget of a payments network to get started. The harness is on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard instead of a procurement cycle, and the white paper’s 12 non-negotiable practices correspond to architecture reviews that security teams already run. Visa’s own conclusion seems like a deadline. The opportunity to stay ahead of attackers at machine speed is still there, the paper argues, and will not remain open.
