Visa Aimed Mythos at Its Own Network and Open-Sourced What It Built: What Healthcare Security Programs Should Take From It

AI Security Series #68

On June 10, Visa published a blog post and technical white paper announcing that they had aimed Anthropic's Claude Mythos at the infrastructure behind their global payment network — more than 200 countries and territories, roughly 160 currencies, nearly 5 billion payment credentials connected to more than 175 million merchant locations — and open-sourced the harness that governed the entire exercise. Rajat Taneja, Visa's president of technology, walked through the results at VentureBeat's VB Transform 2026 conference on July 28.

For healthcare security programs, this is worth reading carefully. The Visa case study is the most detailed public account of a major critical infrastructure organization deploying Mythos-class AI for defensive security work, the harness they built is freely available on GitHub, and the three practitioner takeaways — a new remediation metric, a supply chain hardening commitment, and a 12-practice architectural framework — are directly applicable to healthcare security programs regardless of whether they ever touch Mythos.

What Mythos Found at Visa

Visa joined Project Glasswing — Anthropic's program that gives vetted critical infrastructure organizations access to Mythos for defensive security work — to test decades of hardening at AI speed. The goal was to learn where an advanced model could push its defenses further, not to validate that the defenses were already good enough.

Inside Visa's environment, Mythos demonstrated the capability that has made it significant for defensive security: system-wide, context-aware analysis that surfaces vulnerabilities buried deep in the stack and flags issues that grow more serious when chained together. The model stitched minor weaknesses into working exploit chains that would traditionally have surfaced only late in penetration testing. Some findings carried critical severity ratings. Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any external actor could have acted.

That confirmation mattered, Taneja said — but the epiphany that followed mattered more. "In a world of agentic attacks, defense also has to be agentic." Even at a company that has invested decades in defense-in-depth, Mythos revealed assumptions the team had been operating under that needed rethinking. Traditional SAST tools keep their place as a first pass against known vulnerability patterns, Visa's white paper notes, but pattern matching alone cannot follow an adversary who reasons through logic, data flow, and the exploit chains that live between the signatures. We covered this same dynamic in the ThreatDown report from last week: the asymmetry problem isn't that AI attackers are more creative, it's that they're more systematic, and systematic reasoning at machine speed finds the chains that signature-based scanning misses.

The Visa Vulnerability Agentic Harness

Visa's response to what Mythos showed them was not another monolithic scanner. The team built the Visa Vulnerability Agentic Harness — now in its fifth generation — as a governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. It is now open source on GitHub.

The harness operates across four phases and eleven stages: code ingestion and threat modeling, deep-dive analysis, exploit chain synthesis, and remediation with fix validation. Three design choices drive finding quality. Threat modeling runs before analysis to focus on the actual attack surface rather than scanning everything blindly. Multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances — a single model's output doesn't constitute a confirmed finding. Structured triage artifacts compress the lifecycle from discovery to a result developers can actually ship.

A few operational details worth noting for security teams evaluating the harness. A plain scan in the shipped profile runs all eleven stages and edits source files in fix mode, applying candidate patches unless the operator stops it at detection — it runs hot by default, which means governance of the pipeline itself is a first-order concern. The harness is multi-model by design, with an LLM abstraction layer that allows swapping or combining providers. The exception the documentation is candid about: applying a fix requires file-editing tools that only Anthropic's backends currently expose, so the remediation and validation stages require Anthropic models for full functionality. An OpenAI-compatible model in those stages is limited to report-only output.

The GitHub repository had 595 stars and 97 forks as of July 20. The white paper's 12 non-negotiable architectural practices are included in the documentation. Neither the harness nor the practices require a payment network's budget to implement.

Mean Time to Adapt: A Better Metric

The most immediately actionable contribution from the Visa white paper may be the metric they invented to replace legacy measures. Finding vulnerabilities is no longer the hard part, Taneja argued. The real challenge is how quickly a team can confirm an issue is truly exploitable, fix it, and prove the attack path is closed rather than just showing a patch was applied. Visa calls this Mean Time to Adapt, and it tracks three dimensions.

Inventory freshness measures how current and complete the organization's view is of code, configuration, and runtime deployment. Exploitable paths per release counts how many end-to-end attack chains remain possible after each release — not just how many findings were closed. Validation cycle time tracks how long it takes to produce repeatable, evidence-backed proof that a fix works and stays working in production.

The distinction from legacy measures matters because traditional metrics such as mean time to detect and raw CVE closure counts can look better on paper while actual exposure keeps growing underneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if nobody tested whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters. Visa's own SSDLC policy now assumes every exploitable path will be exercised in production and requires remediation before code is promoted.

Visa's white paper uses CISA Known Exploited Vulnerabilities data to make the prioritization case: fewer than 1% of CVEs are ever actively exploited. The practical implication is that MTTA-based prioritization — focusing on exploitable chains rather than finding counts — is a better allocation of finite remediation capacity than raw CVE closure rates.

AI Agents Are Identities

Among Visa's 12 non-negotiable architectural practices, one deserves specific attention for healthcare security programs: "AI agents are identities." The practice requires scoped permissions, least privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies a system.

VentureBeat's Q2 2026 Pulse research, presented at the same conference, put quantitative stakes on this: 69% of enterprises already run credential sharing somewhere in their agent deployments. Companies with shared credentials report security incidents or near-misses at a 63.5% rate, against 40.9% where every agent has its own scoped identity. That gap — 22.6 percentage points — is what proper agent identity governance is worth in incident rate terms.

We covered this same finding from a different angle in the CISO guide post: Clinton's four-question framework asks explicitly what identity an agent is acting under, and the seven Cowork controls include IdP-issued identity as requirement one. The Visa practice and the enterprise data now give that requirement a quantified risk differential.

For healthcare, the credential sharing finding is particularly acute. Healthcare AI deployments frequently use shared service accounts — a single credential connecting an AI agent to the EHR, another connecting it to the billing system, another connecting it to the imaging platform. Each shared credential is a blast radius multiplier. A compromised shared credential doesn't expose one session; it exposes everything that credential can reach, for as long as the credential is valid. The 63.5% incident rate for enterprises running shared credentials in agent deployments is the actuarial argument for moving healthcare AI agent deployments to scoped, individually issued agent identities now rather than after the first incident.

Project Lightwell and Supply Chain Hardening

Visa has joined Project Lightwell, the $5 billion IBM and Red Hat initiative to harden widely used open-source components through AI-driven validation and coordinated patching, alongside Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends Visa's MTTA logic upstream: a well-defended enterprise stays exposed through weak vendors and weak open-source components, and the MTTA clock does not pause at any single company's perimeter.

For healthcare security programs, Project Lightwell is worth tracking as a precedent. Financial services organizations are collectively funding the hardening of open-source components that underpin their shared infrastructure. Healthcare's equivalent shared infrastructure — HL7 FHIR libraries, open-source EHR components, shared clinical data exchange standards — has no equivalent coordinated hardening program. The open-source components that healthcare AI systems depend on are getting the same AI-assisted vulnerability scanning treatment that found critical issues in Visa's network. Healthcare organizations that assume their open-source dependencies are safe because someone else would have found problems by now are making the same assumption Visa had about its own stack before Mythos ran.

Visa is also making AI-specific security posture a non-negotiable dimension of supplier due diligence, with expectations for continuous vulnerability validation, living software bills of materials, and MTTA baselines across its technology stack. Healthcare organizations building or updating vendor risk management programs should be adding the same requirements. The questions to add to healthcare AI vendor assessments: What is your MTTA baseline for exploitable vulnerabilities? Do you maintain a living SBOM for your AI systems and their dependencies? How do you validate that patches close the exploit chain rather than just addressing the finding?

What This Means for Healthcare

The Visa case study lands at a useful moment for healthcare security programs. The CVP we covered in post #113 gives healthcare organizations with demonstrated defensive security use cases a path to Mythos-class access for their own vulnerability discovery programs. The Visa harness gives them an open-source governed pipeline they can adapt rather than build from scratch. And the MTTA metric gives them a better measurement framework for the remediation work that follows.

Healthcare's vulnerability chain problem is structurally similar to Visa's

Visa's network is a target worth defending obsessively, and Mythos found critical-severity issues through exploit chain synthesis that traditional tooling missed. Healthcare networks share the same structural characteristic that made Visa's engagement valuable: long-lived, complex, heavily interdependent systems where minor weaknesses combine into serious attack chains. Medical device firmware, legacy EHR integrations, clinical network segmentation gaps, biomedical device management systems — these are the kinds of environments where exploit chain synthesis surfaces findings that signature-based scanning cannot.

Healthcare security programs that have access to Mythos through the CVP should be asking whether a structured harness — adapting the Visa open-source release to healthcare's specific code and configuration environments — belongs in their defensive security program. Those that don't yet have CVP access should be evaluating whether the CVP qualification criteria apply to their program.

MTTA is a better metric for healthcare security reporting

Healthcare security programs report to boards, audit committees, and regulators using metrics that often include CVE closure counts, mean time to detect, and vulnerability aging reports. The Visa white paper's argument for MTTA — that closing findings without validating that the exploit chain is broken is a measurement that can look good while exposure keeps growing — applies directly to healthcare security reporting.

Healthcare security programs should consider whether adding exploitable paths per release and validation cycle time to their reporting metrics gives leadership a more accurate picture of actual risk reduction. The additional administrative overhead is real, but so is the governance gap that legacy metrics create. A board that understands MTTA has a more accurate picture of security posture than one reading raw CVE closure rates.

Agent identity is a healthcare compliance issue, not just a security issue

The "AI agents are identities" practice has a specific healthcare compliance dimension that goes beyond the incident rate differential. HIPAA's access control requirements — 45 CFR §164.312(a)(1) — require covered entities to implement technical policies and procedures that allow only authorized persons or software programs to access PHI. An AI agent operating under a shared service account may technically have authorized access, but the audit trail for what that specific agent accessed in which specific session is muddied at best.

Healthcare compliance programs should be assessing whether their current AI agent identity architecture produces the per-agent, per-session access audit trails that the intent of HIPAA access control requirements contemplates. Scoped, individually issued agent identities are the architecture that produces clean audit trails. Shared service accounts are the architecture that produces audit trails that say the credential accessed a resource but can't distinguish which agent session did the accessing.

The open-source harness is a practical starting point for healthcare security teams

The Visa Vulnerability Agentic Harness is on GitHub now. Security teams with Python environments and access to Anthropic API credentials — including through the CVP — can run the harness against internal codebases, configuration repositories, and infrastructure-as-code. The 12 non-negotiable practices in the white paper are the architectural checklist that governed Visa's own deployment and translate directly to any critical infrastructure security program.

The practice of running threat modeling before analysis — focusing the model on the actual attack surface rather than scanning everything — is the same principle behind effective human-led penetration testing. The multi-agent deterministic voting requirement — convergence across independent reasoning chains before a finding advances — is the quality control mechanism that keeps AI-assisted vulnerability discovery from generating noise that overwhelms remediation capacity. Both practices apply to healthcare security programs whether or not they're using the Visa harness specifically.

The Bigger Picture

Visa's Project Glasswing engagement produced three things that matter beyond Visa. A public case study demonstrating that Mythos-class vulnerability discovery finds critical-severity issues in well-defended critical infrastructure. An open-source governed pipeline that any security team can use. And a metric — Mean Time to Adapt — that measures whether defensive investment is actually closing exploitable paths rather than just closing findings.

Taneja's framing at VB Transform is the right frame for healthcare too: the opening to get ahead of machine-speed attackers is still there, and it will not stay open. Healthcare security programs that are waiting for the field to mature before acting on AI-assisted vulnerability discovery are making a timing bet that the Visa white paper argues directly against. The tools are available, the harness is open source, the metric is defined. What's left is the decision to start.

This is entry #68 in the AI Security series. For related coverage, see Black Hat, Meta, and the Irregular Pattern: What Three Weeks of AI Eval Disclosures Tell Us (#67), Project Glasswing: When AI Finds Vulnerabilities Humans Missed for 27 Years, Anthropic's Cyber Verification Program in Practice, and Zero Risk Isn't the Job: What Anthropic's CISO Framework Means for Healthcare Security Programs.