Visa Releases Security AI That Automatically Fixes Vulnerabilities

Visa has released "VVAH (Visa Vulnerability Agentic Harness)," a security tool that not only detects software vulnerabilities but also automatically creates and validates fix code, as open source. The tool executes an 11-step process automatically, with the default setting being to directly modify source code in target repositories without human review. To limit the tool to detection only, operators must explicitly impose restrictions.

VVAH was originally developed starting from Visa's participation in Anthropic's "Project Glasswing." In this project, Anthropic's AI model "Claude Mythos" was used against Visa's payment network to confirm that multiple individually minor weaknesses could be chained together to construct attack methods that actually function. Rajat Taneja, president of Visa's technology division, looking back on this experience, stated: "VVAH initially used only Mythos, and there we experienced the power of semantic reasoning that this new-generation model possesses."

The tool was released on GitHub in June, with 595 stars and 97 forks as of July 20, but exceeded 2,300 stars by August 25, with fork counts surpassing 300. Taneja explained that the repository's clone ratio (the ratio of clones executed relative to visitors) has reached approximately 9%, stating: "Very prominent companies have begun using this tool." However, the repository is currently not accepting code contributions from external sources.

Features were also expanded alongside this release. Whereas the conventional approach focused on three stages—"detection, validation, and reporting"—the new version has evolved into a five-stage cycle of "detection, validation, fixing, verification, and retry." Taneja explained: "If the fix doesn't invalidate the vulnerability, we don't stop there but try again," indicating a design where the AI itself repeatedly confirms the effectiveness of the fix.

Regarding why Visa released this tool for free, Taneja cited protection of the company and its ecosystem as the primary purpose, while citing "having a duty to do good for companies that lack sufficient investment and knowledge in cybersecurity" as the strongest motivation. However, code provision is strictly one-directional; the structure does not involve tools that modify adopting companies' code receiving external contributions in return.

Meanwhile, this default setting has also drawn objections from security experts. Steve Wilson, co-lead of the framework "OWASP Top 10 for LLM Applications" that organizes LLM application risks, has expressed concerns about the design allowing AI agents to modify production environments without human approval. He states: "Authorization gates should be placed outside the model. Agents can present modification proposals, but should not be granted execution authority themselves," and the question of how much autonomous code modification can be permitted has emerged as an industry-wide issue.

What this tool raises is the question of "where to preserve human involvement" in the wake of AI dramatically accelerating security response speed. Taneja stated: "AI is discovering vulnerabilities at an unprecedented pace in human technological history. The new bottleneck is fixing and proving that the fix worked," arguing that waiting for human review can itself become a risk. How far security automation can be permitted is positioned as a movement that will influence future industry standards and regulatory discussions.