When Pattern Matching Fails Global Payments
Processing money across more than 200 countries in 160 currencies is an exercise in managed paranoia. Visa supports nearly 5 billion credentials across 175 million merchant locations, so a single unhandled edge case in core routing isn't an engineering inconvenience—it's a global event. For years, defending that surface meant layering zero-trust controls, segmenting internal networks, and running continuous static analysis.
Then AI models stopped just outputting text and started reasoning through code.
When Anthropic launched Project Glasswing to test its Claude Mythos model against critical software infrastructure, Visa signed up. The broader trial was an eye-opener: in the first month alone, Glasswing participants flagged over 10,000 high- or critical-severity vulnerabilities across software systems worldwide. Anthropic's team realized the real industry bottleneck wasn't finding bugs anymore. It was verifying whether an issue was actually exploitable, delivering a patch, and proving the fix held.
Inside Visa, Mythos did something traditional scanners couldn't touch. Static analysis tools (SAST) excel at pattern matching against known signatures, but they collapse when an adversary bridges minor weaknesses across disparate sub-systems. Mythos evaluated Visa's environment holistically, stitching isolated, low-severity code anomalies into fully functional exploit chains deep in the stack.
Visa's existing zero-trust architecture and network segmentation successfully broke those chains before an external attacker could have leveraged them. But as Visa President of Technology Rajat Taneja pointed out, the test forced a hard realization: in an era of machine-speed, agentic attacks, passive defense falls apart. Defenders have to deploy agents of their own.
Anatomy of the Agentic Harness
Rather than buying another static scanner or piling on manual review steps, Visa built an automated, governed pipeline. Co-authored by Taneja and CISO Subra Kumaraswamy, the Visa Vulnerability Agentic Harness—now in its fifth internal iteration—was open-sourced on GitHub on June 10, 2026, alongside a technical white paper detailing 12 non-negotiable architectural practices for critical software.
Taneja, who joined Visa in 2013 from Electronic Arts after a 15-year tenure at Microsoft and took over Visa's tech strategy in 2019, designed the system to avoid common AI pitfalls. The harness spans four distinct phases and eleven stages, moving systematically from initial code ingestion to threat modeling, deep-dive verification, exploit chain synthesis, automated remediation, and final fix validation.
Three structural design choices prevent the pipeline from hallucinating false positives or spamming developers:
- Threat modeling before scanning: The pipeline maps the active attack surface first, preventing the model from wasting cycles on unexposed code paths.
- Multi-agent deterministic voting: A finding only advances if independent reasoning chains reach consensus across multi-agent votes.
- Structured triage artifacts: Output is packaged into standardized SARIF files and clean patches that developers can immediately review or merge.
The harness runs aggressive defaults. In its standard execution profile, it processes all eleven stages and directly edits source code in target repositories to apply candidate fixes—unless a human operator explicitly pauses execution at the detection gate.
It's strictly multi-model by design. An internal abstraction layer allows security teams to swap between Anthropic Claude, OpenAI-compatible models, or hybrid configurations. However, the documentation notes an important caveat: full remediation and fix-validation stages currently depend on file-editing capabilities exposed by Anthropic backends. OpenAI-compatible models operating in those specific stages are restricted to report-only output.
That flexible control plane aligns with broader market shifts. VentureBeat's Q2 2026 Pulse research reveals that 82% of enterprises currently rely on provider-native security controls, but 59% plan to adopt or replace their agent security tooling within the next 12 months.
Ditching Vanity Metrics for Mean Time to Adapt
The most radical part of Visa's blueprint isn't the open-source code; it's how they measure success. Traditional security metrics like Mean Time to Detect (MTTD) or monthly CVE closure counts are dangerously misleading. A team can close 500 minor CVE tickets a month and celebrate a glowing compliance dashboard while completely ignoring three multi-stage exploit paths that remain wide open in production.
To replace those vanity metrics, Visa introduced Mean Time to Adapt (MTTA), which tracks security health across three realistic dimensions:
- Inventory Freshness: How complete and up-to-date is the organization's real-time view across source code, cloud configurations, and running deployments?
- Exploitable Paths Per Release: How many end-to-end attack chains survive each software build, regardless of raw vulnerability counts?
- Validation Cycle Time: How quickly can the team generate repeatable, evidence-backed proof that a deployed fix actually neutralizes the attack path in production?
This shift is backed by empirical data. CISA's Known Exploited Vulnerabilities catalog shows that fewer than 1% of published CVEs are ever actively weaponized in the wild. Burning developer bandwidth on harmless theoretical bugs while complex exploit chains linger is bad engineering. Visa's Secure Software Development Lifecycle (SSDLC) policy now assumes that every valid, exploitable path will eventually be tested in production—requiring verified remediation before code can be promoted.
Enforcing AI Posture Across the Supply Chain
An enterprise can harden its internal microservices for years, but a single compromised third-party library or vendor API renders that work useless. Visa is extending its defensive standards beyond its own network boundaries.
Under Visa's updated vendor framework, third-party software providers must demonstrate continuous vulnerability validation, maintain living Software Bills of Materials (SBOMs), and establish clear MTTA baselines across their stacks.
Visa has also joined Project Lightwell, a $5 billion open-source security initiative launched by IBM and Red Hat. Alongside peer institutions like Bank of America, JPMorganChase, Goldman Sachs, and Mastercard, Visa is funding AI-driven automated testing and coordinated patching for critical open-source infrastructure. The reasoning is pragmatic: an exploit path through a shared open-source utility resets the MTTA clock for everyone.
What Happens When Autonomous Agents Start Transacting
Looking ahead, Taneja highlighted the next major shift: agentic commerce. As autonomous AI agents begin making purchasing decisions and negotiating transactions on behalf of consumers and enterprises, payment networks must evolve to evaluate non-human buyers.
Visa is developing dedicated trust frameworks, machine identity protocols, and agent readiness scoring systems. Part of this work takes place inside the Visa Payment Threats Lab, a specialized sandbox where synthetic AI fraud tactics are executed against live authorization logic, thresholds, and fraud detection rules to identify hidden vulnerabilities.
The core bottleneck remains identity. VentureBeat's Pulse data shows that 69% of enterprises currently permit credential sharing among AI agents. Organizations engaging in credential sharing report security incidents or near-misses at a rate of 63.5%, compared to 40.9% for teams enforcing unique, scoped agent identities. This matches broader industry warnings around how unmonitored non-human accounts break existing enterprise identity controls, as detailed in SpendLens' research on governing machine identities across AI fleets.
Visa's technical paper explicitly lists "AI agents are identities" among its 12 core practices, mandating scoped API keys, least-privilege policies, detailed audit logging, and full integration into enterprise IAM platforms.
Taneja summarized Visa's strategy into three operational priorities: shift security left so exploitable flaws are designed out during architectural design, aggressively replace under-supported upstream dependencies, and refactor security controls so detection and remediation run autonomously under human governance.
With the harness freely available on GitHub (accumulating 595 stars and 97 forks as of July 20), the tooling isn't limited to global financial giants. As Visa's report stresses, the window for defenders to get ahead of machine-speed attack models is open right now—but it won't stay open forever.
