Visa’s payment network spans more than 200 countries and territories, moves money across roughly 160 currencies, and links nearly 5 billion payment credentials to more than 175 million merchant locations. It also, as it turns out, had a lot of vulnerabilities waiting to be found.
That discovery came courtesy of Anthropic’s Claude Mythos Preview model, deployed inside a collaboration called Project Glasswing that kicked off around April 7, 2026. Within the first month, the AI model surfaced more than 10,000 high or critical vulnerabilities buried across Visa’s software stack.
What Claude Mythos actually did differently
Traditional vulnerability scanning tends to catch the obvious stuff. Claude Mythos did something harder: it stitched together minor, individually unremarkable weaknesses into complete exploit chains, connecting dots that a human tester might not have linked until late in an engagement, or might have missed entirely.
Rajat Taneja, Visa’s president of technology, presented the results at VB Transform 2026 and made a point that deserves attention. His team moved away from traditional remediation metrics and replaced them with a concept they invented internally: Mean Time to Adapt. Patching is reactive. Adapting implies a continuous posture against a threat environment that is itself moving.
Visa’s existing architecture also held up under the scrutiny. The company’s zero-trust framework and network segmentation prevented any of the identified vulnerabilities from being exploited during the exercise.
Visa open-sources the harness, Anthropic backs it with $100M in credits
On June 10, 2026, Visa published the Visa Vulnerability Agentic Harness, or VVAH, on GitHub as an open-source project. The harness is the multi-model orchestration layer that governed the entire vulnerability hunt: discovery, remediation support, and validation, all wrapped into one framework that any organization can now pick up and use.
Anthropic provided Visa with up to $100M in credits for Project Glasswing, along with an additional $4M specifically earmarked for the open-source work.
Claude Mythos itself remains unreleased to the general public. Visa’s engagement with the Preview model puts it among a select group of early-access partners stress-testing Anthropic’s most capable systems on real-world production environments rather than benchmark suites.