Global payment giant Visa has officially open-sourced its security tool, the 'Visa Vulnerability Agentic Harness', on GitHub following a successful system scanning trial using Anthropic's Claude Mythos model. Announced at the VB Transform 2026 conference, this tool has enabled Visa to automatically detect and chain minor security vulnerabilities into complex attack sequences that are typically only discoverable through deep penetration testing. This move marks a significant shift for the financial giant toward proactive, AI-driven defense mechanisms.
Background & Context
Visa's payment network connects nearly 5 billion accounts and processes billions of transactions daily worldwide, making it a prime target for cyberattacks. Rajat Taneja, President of Technology at Visa, shared that the company's security philosophy has always been built on 'extreme paranoia and skepticism'—operating under the assumption that systems will fail to establish rigorous defense-in-depth layers.
When Anthropic launched Project Glasswing to test its next-generation AI model, Mythos, on critical infrastructure, Visa immediately participated. According to Anthropic, this large-scale trial detected over 10,000 critical vulnerabilities in its first month across various core industry software systems. For Visa, this was a golden opportunity to test the resilience of its decades-old security systems under the superior processing speeds of AI.
Technical Analysis & Technology
The tool open-sourced by Visa is not a traditional monolithic security scanner, but rather a highly steerable orchestration pipeline. The current version has undergone five generations of development, operating across four phases and 11 steps—ranging from source code ingestion and threat modeling to patch suggestion and automated validation.
The system's architecture is designed as a multi-model framework, allowing flexible integration between Anthropic's Claude and OpenAI-compatible models. However, the accompanying technical documentation frankly acknowledges a limitation: the current automated patching and validation phase remains entirely dependent on Anthropic's models due to requirements for specialized file editing tools that OpenAI does not yet fully support. A distributed multi-agent voting mechanism is also implemented to ensure maximum accuracy before outputting alert results.
Expert Insights & Perspectives
According to a survey report by VentureBeat, approximately 82% of enterprises still rely entirely on native security controls from AI model providers, and nearly 60% plan to replace their agent-based security tools this year. Rajat Taneja emphasized that in the era of agentic attacks, defensive systems must be equally automated. Visa also proposed that the security industry move away from traditional metrics like the number of vulnerabilities detected, suggesting a proprietary concept called 'Mean Time to Adapt' (MTTA) to measure the speed of resolving real-world attack chains.
Impact & Future Outlook
Looking ahead, Visa is preparing for a new wave where AI agents begin executing transactions on behalf of humans. To counter this risk, Visa has established a Payment Threats Lab to simulate AI-driven fraud scenarios and continuously optimize its detection algorithms.
Visa's free release of this toolkit on GitHub opens up major opportunities for cybersecurity teams in Vietnam to access advanced AI-driven defenses without requiring the massive budget of a global financial institution. The company has also established strict principles that treat AI agents as independent identities, requiring least-privilege access control and comprehensive audit logging.