Visa Vulnerability Agentic Harness writes security fixes before review

Visa has expanded the Visa Vulnerability Agentic Harness, its open-source security workflow, from finding and reporting vulnerabilities to generating, validating and iterating on fixes. A standard scan runs all 11 stages and can edit source files in a target repository before a person reviews the change, according to VentureBeat.

The release is consequential for security teams because it moves the automated boundary beyond detection and triage. It does not, based on the available evidence, establish that Visa’s tool independently merges, releases or deploys patches to a live production environment. Visa told VentureBeat that VVAH is a harness rather than a merge tool.

Does Visa Vulnerability Agentic Harness deploy code changes?

No autonomous deployment is documented in the reporting. VVAH writes a proposed remediation into the code repository’s source files unless an operator limits the run to detection. That is a meaningful authority level, but it is different from approval, merging and release. Visa said the harness is intended for authorized operators assessing code they own in a controlled environment.

Rajat Taneja, Visa’s president of technology, described the change as an expansion from discovery, verification and reporting to a loop covering discovery, verification, remediation, validation and iteration. Visa’s premise is that identifying flaws has become faster than proving they have been fixed. The company said some resolution cycles have fallen from weeks to hours, a performance claim not independently verified in the material available.

What VVAH automates, and what it does not

• It finds and analyzes vulnerabilities: the revised workflow uses an abstract-syntax-tree call graph to map code paths and assess how an attacker might reach them, VentureBeat reported.
• It generates and writes a fix: the default run proceeds to remediation and edits source files before a human approval step.
• It assesses its own patch: an adversarial panel evaluates whether the proposed change negates the exploit. A failed attempt feeds information into a subsequent iteration.
• It does not run a conventional software-verification pipeline: the reported README says stage 11 is read-only, and VVAH does not compile, build or run tests against the modified code tree.

That last boundary should shape how teams assess the product. An adversarial judgment that a patch blocks a particular exploit is not the same as evidence that the change builds, passes regression tests, fits change-management policy or is safe to deploy. Teams considering an agentic workflow need task-specific validation criteria, rather than treating a model’s internal review as a broad quality guarantee. Venture Post’s guide to evaluating AI models for the work they will actually do lays out that distinction.

The governance question is the default

Visa’s June Project Glasswing white paper says AI agents that modify systems should have scoped permissions, least privilege, audit trails and identity-and-access-management governance, VentureBeat reported. Yet the released workflow has no approval gate between patch generation and the resulting edited file.

Steve Wilson, Exabeam’s chief AI and product officer and an OWASP Top 10 for LLM Applications project co-lead, argued that authorization for consequential changes should sit outside the model. His view is an expert recommendation, not a finding about VVAH, but it identifies the central operating choice: whether automated remediation can modify a working tree by default, or should first produce an evidence-backed patch for policy-controlled review.

This story draws on original reporting from VentureBeat.