Visa open-sources AI-powered cyber defense system after vulnerabilities exposed

Visa just handed the entire enterprise world a free cybersecurity toolkit, and the reason it exists is slightly terrifying. The payments giant open-sourced its Visa Vulnerability Agentic Harness, or VVAH, in June 2026 after a collaboration with Anthropic’s Project Glasswing revealed more than 10,000 high and critical vulnerabilities across industry systems in the first month of testing alone. The tool, released under an Apache 2.0 license, is designed to find, prioritize, fix, and verify security flaws using an AI-driven pipeline. How a stress test became a product launch The backstory starts in April 2026, when Visa joined Anthropic’s Project Glasswing. The initiative involved deploying Anthropic’s Claude Mythos AI model against Visa’s sprawling global payment infrastructure, a network spanning over 200 countries, roughly 160 currencies, and nearly 5 billion payment credentials. Rather than quietly patch things and move on, Visa built VVAH as a structured response framework. The system operates as a four-phase pipeline covering discovery, triage, remediation, and validation. It uses a zero-trust architecture, meaning every component assumes it’s already been compromised and verifi...