Visa releases AI-powered security harness that automatically patches code in production

Automated Security Patching

Visa has released an open-source security AI called the Visa Vulnerability Agentic Harness (VVAH). This system is designed to automatically detect vulnerabilities, generate code fixes, and validate those patches in production environments. The full 11-stage process, which includes editing source files, runs by default unless specifically configured for detection-only mode.

Context and Industry Debate

The release of VVAH with its default autonomous patching capability follows recent security concerns, such as the GhostJacking attack demonstrated at DEF CON 34, where an AI agent exploited a log file to rewrite DNS. This has led to discussions within the industry regarding the appropriate level of human oversight for AI agents, with some experts advocating for authorization gates before AI-proposed changes are implemented.

Addressing the Bottleneck

Rajat Taneja, Visa's president of technology, stated that the VVAH addresses a new bottleneck in cybersecurity: the speed at which humans can fix vulnerabilities compared to AI's ability to find them. He views the autonomous default as a product feature designed to accelerate the patching process. VVAH evolved from Visa's involvement in Anthropic's Project Glasswing, where the Claude Mythos model was used to identify potential exploits in Visa's network.

Open-Source Adoption

The VVAH was made available on GitHub in June and has seen increasing adoption. Since July 20, its star count has grown from 595 to over 2,300, and forks have increased from 97 to over 300 by August 25. Taneja noted a clone-to-visitor ratio near 9% and reported that several high-profile companies have begun using the harness, aligning with Visa's stated obligation to contribute to the broader security ecosystem.