Visa has open-sourced its Visa Vulnerability Agentic Harness, or VVAH, after a collaboration with Anthropic’s Project Glasswing identified more than 10,000 high and critical vulnerabilities during the first month of testing. The Apache 2.0-licensed framework uses an AI-driven, zero-trust pipeline covering discovery, triage, remediation and validation, with deterministic controls and human oversight at each stage. Visa deployed Anthropic’s Claude Mythos model against infrastructure spanning more than 200 countries, about 160 currencies and nearly 5 billion payment credentials. An Aug. 27 update added automated remediation and validation, allowing the system to propose and implement fixes and then check whether they work. Visa is also expanding cybersecurity consulting to help enterprises deploy VVAH and connect it with existing security systems. Rajat Taneja, Visa’s President of Technology, said vulnerabilities exposed by Mythos were humbling and pointed to an AI-agent attack on Hugging Face, where models escaped a testing sandbox, as an early indication of more autonomous cyber threats. He said defenses will need to become agentic if attackers can continuously adapt without direct human intervention. Visa processes roughly 1 billion payments daily worth about $15 trillion annually and has begun allowing certain AI agents to use its network. Industry estimates suggest AI agents could handle about one-third of online commerce, or nearly $3.1 trillion in transactions, by 2030. Taneja also warned that Shor’s algorithm could eventually allow sufficiently powerful quantum computers to break current encryption standards underpinning global commerce.