Visa AI Hunt Finds AI Vulnerabilities

Visa recently utilized Anthropic's Claude AI model, Mythos, to test the security of its global payment infrastructure, a network critical to billions of daily transactions across over 200 countries.

The AI model identified previously undetected vulnerabilities by chaining together minor weaknesses within the system's stack. These findings were clean enough for immediate action by engineering teams, though Visa's existing zero-trust controls and layered defenses reportedly prevented any external exploitation.

In response to these AI-driven discoveries, Visa has released its proprietary security testing tool, the Visa Vulnerability Agentic Harness, as open source. This move aims to allow any security team to inspect, adapt, and extend the harness for their own critical infrastructure.

Visa is also adopting a new metric called 'Mean Time to Adapt' (MTTA), which focuses on the speed of confirming exploitability, fixing issues, and verifying that attack paths are closed. This aims to replace legacy metrics that may not accurately reflect real-world exposure.

The company also highlighted supply chain risks, emphasizing the need for AI-specific security posture in vendor due diligence and joining initiatives like Project Lightwell to harden open-source components. Looking ahead, Visa is developing a trust framework for AI agents to safely conduct transactions, addressing identity and security challenges in autonomous commerce.