🔍 Contexte : Le 22 octobre 2026, Forever Security publie une recherche issue d'une détection en conditions réelles sur la machine d'un client. L'article documente un vecteur d'attaque inédit ciblant les agents IA de codage (OpenAI Codex et Anthropic Claude Code).

50,000 findings sorted by CVSS isn't a priority list. See the 12 that reach a crown-jewel asset.

During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations.  Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains.  In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews.  VVAH has an 11-step process divided into four parts. Contextual Threat ModelingUsing wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning.  Noise Reduction & Consensus Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams.  Model Agnosticism & Remediation Limits Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly.  Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes.  Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.

(Pre-print to follow on ResearchGate) An LLM fails when it must resolve ambiguity without sufficient authority to determine which interpretation governs. Co

# CrowdStrike's Agentic Security Platform: What Developers and Security Teams Need to Know *CrowdStrike rewrites security architecture with AI agents that code, hunt, and respond autonomously.* CrowdS...

#AISécurité #IAAgentique #SécuritéNumérique #Innovation #Technologie

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

The Tech Field Day Podcast is the only podcast that dares to be both on topic, or on premise, and sometimes on location, bringing together a group of independent IT luminaries and experts in their…

30 days running Claude Mythos Preview against our own code: reproducing exploits, real dollar costs, and why every security team is next.