Excavating truth from the code’s buried layers.
Last week, a press release crossed my desk: Visa, the global payments titan, has deployed Anthropic's "Claude Mythos" to detect vulnerabilities in its payment infrastructure. The announcement was glowing—a triumph of AI in financial security. But as a Zero-Knowledge researcher who has spent years dissecting smart contract failures and systemic risks, I found the lack of technical detail more alarming than any hidden bug.
No architecture. No benchmarks. No false-positive rates. No open-source code. In the crypto world, we would never trust a protocol that published such a sparse audit report. Why should we trust the backbone of the global payment system to do the same? The silence itself is a vulnerability.
Let me be clear: I am not anti-AI. I have built ZK provers for machine learning inference. I know the promise of automated code analysis. But the path Visa has chosen—a proprietary, black-box AI model for security—is the antithesis of the verifiable, decentralized trust that blockchain technology champions. It is a step backward, wrapped in a shiny press release.
Context: The Payments Colossus Meets the AI Oracle
Visa processes over 200 billion transactions annually, moving trillions of dollars across 200+ countries. Its security is not just a corporate concern; it is a matter of global financial stability. The decision to augment its security team with an AI model from Anthropic—creator of the Claude series, known for its "Constitutional AI" alignment—is logical on the surface. LLMs excel at understanding code semantics, spotting logical flaws that traditional static analysis tools miss.
But the details matter. Claude Mythos is likely a fine-tuned or specially prompted version of Claude 3 (or Claude 3.5) optimized for vulnerability detection. It probably uses a combination of Retrieval-Augmented Generation (RAG) to pull from historical CVE databases and chain-of-thought reasoning to trace attack paths. This is not magic; it is engineering. Yet the press release treated it as proprietary alchemy.
Every bug is a story waiting to be decoded. And the story of Claude Mythos is being told in court—or rather, behind closed doors. For a crypto-native audience, this should sound alarm bells. We have built an entire industry on the principle that security through transparency is the only sustainable path. Visa is doing the opposite.
Core: Deconstructing the Black Box
Let me take you inside what such a deployment likely looks like, based on my own experience auditing large codebases and integrating AI into security pipelines. I once spent six weeks reverse-engineering 40,000 lines of Solidity code to find gas-optimization flaws—a task that would be trivial for a modern LLM. But the differences are instructive.
1. The Model Architecture
Claude Mythos is almost certainly a version of Anthropic's Claude 3.5 Sonnet or Opus, fine-tuned on a dataset of vulnerable code patches. The fine-tuning likely uses supervised learning on pairs of (vulnerable code, fixed code) combined with reinforcement learning from human feedback (RLHF) where security experts rank the model's detection explanations. The "Mythos" moniker may refer to an enhanced context window—perhaps 200K tokens—to analyze entire codebases in one pass.
2. Detection Paradigm
Based on known LLM capabilities, the model likely performs static analysis by reading source code and outputting a probability score for each function or file. It may also generate a natural language explanation and suggest patches. But here's the key: it does not execute the code. It cannot perform dynamic analysis. It cannot prove that a vulnerability is exploitable. It is a pattern-matching engine with reasoning, not a formal verification tool.
In contrast, in the ZK world, we can generate a proof that a specific code path is secure without revealing the entire codebase. Visa's approach lacks this guarantee. The model's output is a probabilistic guess, not a proof.
3. The Data Pipeline
To fine-tune Claude Mythos, Visa likely provided years of internal audit logs, code reviews, and known vulnerability data. This is a massive privacy risk. Navigating the labyrinth where value flows unseen. The AI now carries implicit knowledge of Visa's weakest points. If that model is ever leaked, stolen, or adversarially queried, the consequences could be catastrophic.
Let me illustrate with a simplified pseudocode snippet of what the inference call might look like:
function detectVulnerabilities(code: String, context: History) -> List<Finding> {
prompt = "You are a security auditor for payment systems. Analyze this code for SQL injection, race conditions, and logic flaws. Provide severity, location, and recommendation."
response = claudeMythos.invoke(prompt + code, temperature=0.1, maxTokens=4096)
return parseFindings(response)
}This is powerful, but it is also fragile. A small perturbation in the prompt—an adversarial injection—could cause the model to ignore a critical vulnerability. Unlike a smart contract audit where the code is immutable, the AI's decision boundary is fuzzy.
4. Trade-offs vs Traditional Tools
Tools like Checkmarx, Snyk, and Veracode have been the standard for decades. They are deterministic, rule-based, and auditable. Claude Mythos trades determinism for flexibility. It can find novel vulnerabilities, but at the cost of explainability. When the AI flags a function, can Visa's auditors understand why? If there is a false positive, they waste time. If there is a false negative, a critical bug slips through.
During my work on the DeFi composability map in 2020, I learned that systemic risks often emerge from the interactions of multiple components. A single AI model analyzing code in isolation cannot see these emergent risks. It cannot simulate the behavior of a payment network under load. It cannot test for Oracle corruption or front-running. The model is a tool, not a panacea.
Contrarian: The Single Point of Failure You Didn't See
The mainstream narrative is that AI will make payment networks more secure. I argue the opposite: centralizing vulnerability detection into a single AI system creates a new, brittle attack surface.
- Prompt Injection: If a malicious actor can craft a specific commit message or code comment that influences the model's judgment, they could hide a vulnerability in plain sight. This is not theoretical—researchers have shown that LLMs can be tricked by carefully constructed prompts.
- Data Poisoning: The training data for Claude Mythos includes historical vulnerabilities. If Visa's own codebase contains backdoors from years past—perhaps intentionally inserted by an insider—the model may learn to ignore them. "Normalizing" bias is a well-known problem in ML.
- Model Theft: The model itself is a valuable asset. If stolen, attackers gain a map of all known vulnerabilities in Visa's systems. Unlike a traditional binary, a model can be reverse-engineered to reveal its training data.
- Overconfidence Bias: Security teams may trust the AI's output too much, reducing manual review. When the AI misses a bug, it becomes a single point of failure.
In the crypto ecosystem, we mitigate such risks through decentralization, transparency, and formal verification. Visa's approach is the opposite: centralized, opaque, and based on probabilistic reasoning.
Consider the DAO hack of 2016. The code was open, audited, and yet the reentrancy vulnerability persisted. The solution was not a better AI; it was a fundamental change in execution semantics (the checks-effects-interactions pattern). Visa is using AI to patch holes in a system whose architecture predates the internet. The real fix would be to rebuild the infrastructure on verifiable, modular components—exactly what blockchain-based payment networks are doing.
Takeaway: The Convergence That Demands Proof
We are entering an era where AI and critical infrastructure meet. The Visa-Anthropic partnership is just the first of many. But as a ZK researcher, I see a clear path forward: the only trustworthy AI for security is one whose outputs can be verified independently.
This means using zero-knowledge proofs to certify that a given inference was performed correctly on a specific input without revealing either the model weights or the codebase. Protocols like ezkl and the work by Modulus Labs have shown this is possible. Visa could open-source the proof verifier while keeping the model private—a compromise that maintains security without sacrificing auditability.
Until then, Claude Mythos remains a black box. And as we know in crypto, black boxes are where bugs hide.
Every bug is a story waiting to be decoded. Visa's story is still being written. I hope the next chapter includes a proof—not a press release.