Visa Open-Sourced the AI Harness It Pointed at Its Own Payment Network
Visa ran Anthropic’s Claude Mythos against the infrastructure supporting its global payment network — a system spanning more than 200 countries and territories, moving money in roughly 160 currencies, and connecting nearly 5 billion payment credentials to over 175 million merchant locations.
On 10 June, Visa published the framework that governed the exercise as open source. Taneja set out what followed at VB Transform 2026 in Menlo Park on 14–15 July, including a conclusion he put plainly: “In a world of agentic attacks, defense also has to be agentic.”
That framework, more than the findings, is what other security teams can act on.
What the test produced
| Programme | Anthropic’s Project Glasswing, which invited organisations behind critical software to test the model |
| What the model did | Chained minor weaknesses across separate parts of Visa’s stack into potential attack paths |
| Severity | Some findings rated critical |
| Visa’s position | Existing zero trust architecture, network segmentation and layered controls prevented the weaknesses from forming complete attack paths usable by an external attacker |
| Programme-wide claim | Anthropic states Glasswing participants collectively identified 10,000+ high or critical severity vulnerabilities in the first month across critical software industry-wide |
The model found weaknesses that individually looked minor and connected them — the kind of result that conventional tooling typically surfaces only during later-stage penetration testing. Visa’s claim is not that its network was insecure, but that a model reached conclusions earlier in the cycle than the existing process would have.
The harness, and how it runs
Visa’s president of technology Rajat Taneja and chief information security officer Subra Kumaraswamy co-authored the June post releasing the Visa Vulnerability Agentic Harness on GitHub as a reference implementation.
| Pipeline | Four phases, eleven stages — code ingestion, threat modelling, vulnerability analysis, verification, exploit chain construction, remediation and fix validation |
| Threat modelling | Runs before analysis, to focus on the attack surface rather than scanning everything |
| Verification | Multi-agent deterministic voting — a finding must converge across independent reasoning chains before advancing |
| Output | Structured triage artifacts intended to compress discovery into something a developer can act on |
| Fix mode | Edits source files in the target repository, applying candidate patches unless the operator stops it at detection |
| Also published | A technical white paper covering the architecture, lessons learned, and 12 architectural practices Visa describes as non-negotiable for critical infrastructure |
On fix mode: a plain scan in the shipped profile runs all eleven stages and will edit source files in the target repository unless an operator intervenes. Anyone evaluating this framework should establish where that stop sits before pointing it at anything they care about.
The dependency inside the open source
The open-source version runs with Anthropic models, OpenAI-compatible models, or a mix — but not in every role. Per VentureBeat, applying a fix requires file-editing tools that only Anthropic backends expose. The remediation and validation stages therefore need Anthropic models for full functionality, and an OpenAI-compatible model in those roles is limited to report-only output.
So the framework is inspectable and adaptable, and the discovery half is provider-flexible. The half that closes the loop is not.
Why that matters commercially. VentureBeat’s Q2 2026 Pulse research found 82% of surveyed enterprises rely on provider-native controls as their primary security layer, and 59% plan to adopt or switch agent security tooling within the year. A framework that is portable for finding bugs and provider-bound for fixing them sits awkwardly against an intention to switch tooling.
Where the bottleneck actually sits
The headline number from Glasswing is 10,000-plus vulnerabilities in a month, a volume that compounds a problem already documented — AI finding flaws faster than anyone can patch them. Anthropic’s own stated conclusion undercuts the significance of that figure: the bottleneck falls after discovery — in verification, disclosure and patching speed.
VentureBeat reports Taneja making the same point about the Visa exercise: finding vulnerabilities, he argued, is no longer the hard part.
What the 10,000 figure does not tell you. It is Anthropic’s own count of findings from its own programme, using its own model, with no published methodology for how severity was assigned or how many findings were confirmed as exploitable. Visa’s statement that its layered controls prevented complete attack paths is the clearest available indication that raw finding counts and real-world risk are different measures.
Visa changed how it measures a fix
Reporting on the VB Transform session notes that Visa abandoned traditional remediation metrics in favour of a measurement its own team devised. Taneja’s framing of the problem explains why: the difficulty is not finding an issue but confirming it is actually exploitable, fixing it, and then proving the attack path is closed — rather than showing that a patch was applied.
Those are different claims. A patch-applied metric records an action. A path-closed metric records an outcome. Most vulnerability management reporting measures the former because it is easier to count.
Where the industry actually sits. VentureBeat research published this month found 53% of enterprises have already had an agentic security incident or near-miss. 65% enforce agent permissions at runtime, but only 18% isolate their highest-risk agents, and just 8% pair enforcement with isolation. Visa is operating several steps ahead of that distribution, which is worth holding in mind when reading its results as a template.
What this signals for security teams
Capability and tooling are separate questions here.
On capability: a model chaining low-severity weaknesses into exploit paths across a large, heavily hardened estate is a meaningful demonstration, and Visa’s network is an unforgiving test bed. That capability exists regardless of which vendor supplies it — and it arrives at organisations that mostly cannot yet account for what their existing AI agents can reach.
On tooling: Visa publishing its harness gives security teams a reference implementation to inspect rather than a product to buy, which is a more useful contribution than a case study. The dependency in the remediation stages is a constraint on that contribution rather than a refutation of it.
The practical question for any team evaluating this is not whether AI can find vulnerabilities — that is now demonstrated repeatedly — but whether the organisation can verify, prioritise and patch at the rate the finding tools now produce output. On the evidence of both Anthropic’s and Visa’s own conclusions, that is where the constraint has moved.
My Take — Mr Wangdoo
The open-sourcing is the more consequential half of this story, and it is being reported as the footnote to the bug count.
A vulnerability count from a vendor testing its own model is a marketing artifact. A published pipeline that anyone can read, run and criticise is evidence. Visa releasing the harness invites the scrutiny a press release avoids. The provider dependency in the remediation stages is discoverable precisely because of that decision.
What I would want before drawing conclusions is the part nobody has published: how many of those findings were confirmed exploitable, how many were false positives, and how long remediation took. Discovery volume without those denominators tells you how much output a tool generates, not how much risk it removed.
The most useful line in the coverage is Taneja’s, and it is not a claim about AI capability — finding vulnerabilities is no longer the hard part. Any organisation now able to generate ten thousand findings in a month has to answer what happens to finding number nine thousand.
Common questions
What is the Visa Vulnerability Agentic Harness?
An open-source framework published by Visa on GitHub on 10 June 2026, governing a four-phase, eleven-stage pipeline for AI-assisted vulnerability research. It runs threat modelling before analysis, requires findings to converge across independent reasoning chains before advancing, and produces structured triage output. In fix mode it edits source files in the target repository.
Does it work with models other than Anthropic’s?
Partly. The discovery stages support other providers, but per VentureBeat the remediation and validation stages require Anthropic models, because applying a fix depends on file-editing tools only Anthropic backends expose. An OpenAI-compatible model in those roles is limited to report-only output.
Was Visa’s payment network found to be vulnerable?
Visa states its existing zero trust architecture, network segmentation and layered security controls prevented the identified weaknesses from forming complete attack paths exploitable by an external attacker. The model chained minor weaknesses into potential paths that conventional tooling would typically surface later in penetration testing.
What is Project Glasswing?
An Anthropic programme inviting organisations responsible for critical software to test its Mythos model. Anthropic states participants collectively identified more than 10,000 high or critical severity vulnerabilities in the first month. That figure is Anthropic’s own and has not been independently verified.
Sources
- VentureBeat — “Visa used Mythos to hunt for bugs in its own payment network, then open-sourced the harness that made it possible,” 28 July 2026. venturebeat.com
- VentureBeat — “Four of five enterprises that secured AI agent identities still can’t contain one that goes rogue,’’ August 2026, for the agentic incident and isolation figures. venturebeat.com
- Open Source For You — “Visa Open Sources AI Security Harness After Mythos Test.” opensourceforu.com
- Crypto Briefing — on network scale, severity ratings and the four-phase harness structure. cryptobriefing.com
