Visa’s open-source security harness can now identify, patch, and validate software vulnerabilities before human reviewers examine the proposed changes. The latest release of the Visa Vulnerability Agentic Harness (VVAH) enables its full 11-stage workflow by default, including an adversarial validation panel for proprietary patches.
When operators do not limit the workflow, VVAH scans the target repository, identifies exploitable weaknesses, edits source files, and attempts to verify whether the proposed fixes block the attack path. The update shifts the platform from vulnerability discovery and reporting toward automated remediation and iterative security validation.
Thursday’s announcement also included the expansion of Visa Consulting & Analytics’ cybersecurity advisory services. The release arrives as security researchers continue to examine the risks of autonomous AI agents. Tenet Security’s GhostJack research described an attack chain in which an AI agent read an attacker’s payload from a log file and rewrote DNS configurations using valid credentials.
Steve Wilson, chief AI and product officer at Exabeam and project co-leader of the OWASP Top 10 for LLM Applications, has argued for a more restrictive approach. “The first thing I would do is put an authentication gate on the outside of the model,” Wilson said in a written response. “An agent can suggest precise DNS changes, but it cannot authorize itself to make them.”
Visa moved the security pipeline because the bottleneck moved
Rajat Taneja, president of technology at Visa, rejects the idea that VVAH’s default workflow is simply a risk decision. He describes it as a response to a changing software security bottleneck.
“The bottleneck has moved,” Taneja told VentureBeat in an exclusive interview. “AI has discovered vulnerabilities faster than humans in the history of our technology industry. The new bottleneck is fixing the problem and proving that it’s fixed.”
VVAH emerged from Visa’s participation in Anthropic’s Project Glasswing. During the project, Visa tested Claude Mythos against systems supporting billions of transactions and observed how the model could connect seemingly minor weaknesses into functioning exploit chains.
“VVAH was initially using Mythos entirely, and that’s when all of us as part of Project Glasswing realized the power of this new class of models that do semantic reasoning,” Taneja said.
Visa published the harness on GitHub in June. According to Taneja, the repository grew from 595 stars and 97 forks on July 20 to more than 2,300 stars and 300 forks by August 25, with a clone-to-visitor ratio of nearly 9%.
“There are some very high-profile companies that have started using this harness,” he said.
Visa says the project reflects its technology DNA and was built “to protect Visa and our ecosystem.” Taneja also cited an obligation to “do good by doing right” for companies that may not have the same level of cybersecurity investment or expertise.
The repository is not currently accepting external code contributions. As a result, outside users can review and run the harness, but the system that modifies a target repository does not automatically incorporate community code into VVAH itself.
The latest release expands the workflow beyond vulnerability reporting. “We’re going from discover, verify, report, and fix to discover, verify, fix, verify, iterate,” Taneja said. “If the fix doesn’t disable the exploit, we need structured, automated feedback that preserves the learning from the first run and then reinforces it.”
The updated architecture analyzes repositories around an abstract syntax tree and call graph. This approach maps subroutine calls and the paths an attacker might follow through the code. Taneja said the changes are designed to reduce token usage while improving inference, context, and exploitability analysis.
The release also adds observability across the workflow stages, which Taneja compared to viewing a series of window panes, along with a real-time progress display.
Average Adaptation Time has three definitions
Visa’s Average Adaptation Time, or MTTA, measures the time between discovering an attack vector and resolving the underlying vulnerability. Visa says some remediation timelines can fall from weeks to hours.
Visa introduced a broader MTTA framework in June through its Project Glasswing white paper. The framework tracks three dimensions: inventory freshness, exploitable paths per release, and validation cycle time.
The VVAH repository focuses on the third measure: the elapsed time between AI-assisted exploitability discovery and production-validated remediation. Visa’s board-level reporting may use a shorter interval, so security teams should request all three measurements when comparing results.
Taneja describes MTTA as Visa’s most strategically important security metric because it shifts attention from scanning performance to how quickly an organization can respond.
“It’s not about the discovery. It’s about the correction,” he said.
AI security automation still requires approval gates
Wilson’s concerns extend beyond whether an agent has a human reviewer. “It is important to remember that security rules written within prompts may shape the behavior of the model, but they are still suggestions for the model, not enforceable security controls,” he wrote.
He also acknowledged the trade-off involved in limiting autonomous actions. “The trade-off is that agents lose the ability to improvise arbitrary and high-impact infrastructure changes on their own, while maintaining autonomous investigation and limited periodic remediation,” Wilson said.
VVAH does not place an approval step between the agent’s patching process and the initial modification of the working copy. That raises an important question for organizations deploying AI-powered vulnerability remediation: where do human reviewers enter the workflow?
Visa’s June white paper identifies “AI Agent is Identity” as one of its 12 non-negotiable practices. The principle calls for scoped permissions, least privilege, audit trails, and identity and access management governance for agents that can modify systems.
Visa says its default workflow is designed for authorized operators working against code they own in controlled environments. The company also argues that many legacy security systems mainly provide telemetry, leaving security operations centers and incident response teams to perform much of the analysis and remediation manually.
“Many of the legacy systems in use today are essentially signal providers,” Taneja said. “They’re telemetry, and then there’s a lot of human analysis, and the SOC and security and incident response teams are doing a lot of the heavy lifting during the response.”
According to Taneja, incidents involving model sandbox escapes and autonomous behavior demonstrate why companies need to rethink their security architecture.
VVAH’s adversarial validation stage is intended to provide an automated challenge to each proposed fix. Before a patch is considered verified, Stage 11 evaluates whether the change actually disables the exploit. Failed fixes can then inform the next iteration.
According to the README, Stage 11 runs in read-only mode. VVAH does not compile, build, or run tests on the patched tree. Taneja describes the harness as a “governance architecture on top” of the underlying models, combining automated analysis with threat modeling and business context.
Visa answers questions about human approval and remediation
VentureBeat submitted written questions to Visa after the interview and received responses before publication. Visa reiterated that VVAH is intended for authorized operators running the tool against code they own in a controlled environment.
Visa also clarified that VVAH is a harness rather than a merge tool. “Stage 10 writes suggested fixes to the repository’s working copy. Stage 11 then runs an adversarial validation panel that scores each fix and returns one of three verdicts: verified, failed validation, or requires review,” the company said.
“None of these bypass the normal build, test, and code review flow,” Visa added. “The final decision on remediation is made by the security and engineering teams. In the enterprise, reliability and auditability are not optional.”
This process differs from Wilson’s preferred design. His proposed authentication gate would authorize an action before execution. VVAH writes the suggested patch first, then subjects it to adversarial validation before the change proceeds through an organization’s existing review and deployment processes.
“Our goal is to help security teams work at the speed of AI, not to replace them,” Visa wrote. “VVAH does the iterative part: it finds a problem, tests whether it’s real, and suggests a fix. Before the fix gets to the humans, a Stage 11 adversarial validation panel tries to break it down. That way, the humans spend their time making judgmental decisions instead of triaging noise.”
Visa said it currently uses VVAH internally and had no customers at the time of the initial deployment. The company said the platform can incorporate configuration management database information, threat models, and business risks to help answer a broader question: given how a business operates, which vulnerability should be fixed first?
That business context is a central distinction between VVAH and conventional security scanners, which often stop at identifying and prioritizing findings.
Model selection is a stage-by-stage decision
Another significant change is VVAH’s support for multi-model orchestration. Taneja said different models offer different strengths. “Mythos has very high recall, but the Opus model has very high precision,” he said.
Organizations can assign models to individual stages through configuration instead of modifying the harness code. Visa says the system can incorporate newer GPT releases, open-weight models, and other compatible providers while sharing runtime components, caches, and workflow logic.
“The whole is greater than the sum of its parts,” Taneja said.
VVAH has been model-agnostic since its launch, although earlier configurations required Anthropic’s backend for remediation while OpenAI-compatible backends were limited to reporting. The current README extends repair and validation capabilities to OpenAI-compatible and open-weight models through a shared runtime. Anthropic remains the default provider for both stages, but it is no longer a hard dependency.
This flexibility is increasingly relevant as organizations evaluate AI agent security tools. VentureBeat’s Q2 2026 Pulse survey found that 59% of enterprises plan to adopt or switch to agent security tools this year, while 82% continue to rely primarily on provider-native controls.
Visa also announced a collaboration with Nvidia’s Open Secure AI Alliance and said it would contribute VVAH as a model-agnostic security framework. The announcement comes amid broader investment in open-source AI infrastructure, including Project Lightwell, a $5 billion IBM and Red Hat initiative focused on open-source components.
What to establish before enabling automated fix mode
|
Decision |
What to establish first |
|
Running posture |
Start with –stop-after s9 to review SARIF output before allowing the harness to write changes to source files. |
|
Approval gate |
Map the human approval points across runtime execution, patch review, and merge approval. Clearly identify who owns each gate. |
|
Verification scope |
Use the Stage 11 verdict as an input to review, not as a replacement for your engineering process. Visa says builds, tests, and code reviews remain part of the team’s own workflow, so retest exploits before merging. |
|
Repository scope |
The tool operates with elevated privileges according to its README. Restrict the repositories it can access, run scans in temporary environments, use narrowly scoped credentials, exclude production secrets, and limit network access to the target repository and approved model endpoints. Data sent through SDK, OpenAI, or DeepAgents backends may be transmitted to the applicable provider endpoint. |
|
The role of the model |
Assign models deliberately to each stage. Taneja says recall and precision vary by model, while the README notes that public accuracy and recall benchmarks are not yet available. Organizations should measure performance against their own codebases and threat models. |
The other half of Thursday’s announcement involves consulting services. Visa Consulting & Analytics is adding an executive workshop, a maturity assessment based on the NIST framework, and a cyber risk prioritization roadmap.
“We’ve been getting a lot of calls asking, ‘Can you help us?'” Taneja said, explaining that the consulting practice is intended to help organizations deploy and govern AI-powered security tools.
Carl Rutstein, global head of Visa Consulting & Analytics, summarized the shift: “Finding vulnerabilities is no longer the hardest thing; speed to remediation is the new battleground.”
Source: venturebeat.com