By admin 
Visa has unveiled a significant advancement in its open-source security initiative with the release of an enhanced version of its Vulnerability Agentic Harness (VVAH). This sophisticated tool now autonomously identifies vulnerabilities, generates code patches to fix them, and rigorously tests these patches against adversarial scenarios before any human intervention. The entire automated remediation loop is enabled by default, representing a paradigm shift in how software vulnerabilities are addressed. A standard scan of the Visa Vulnerability Agentic Harness repository on GitHub will trigger all 11 stages of its process, including direct edits to source files in the target repository, unless explicitly configured by an operator to halt at the detection phase.
This groundbreaking announcement on Thursday coincides with a strategic expansion of Visa Consulting & Analytics’ advisory services. The release of VVAH with its default automated remediation capabilities arrives just 18 days after Tenet Security’s dramatic demonstration of "GhostJacking" attacks at DEF CON 34. GhostJacking, a sophisticated attack chain, showcased an agent capable of reading an attacker’s malicious payload from a log file and subsequently rewriting DNS records using valid credentials. This event underscores the evolving threat landscape and the imperative for equally advanced defensive measures. The urgency of such advancements is further highlighted by the concurrent discourse on AI security, with Steve Wilson, Chief AI and Product Officer at Exabeam and a co-lead for the OWASP Top 10 for LLM Applications, advocating for a more cautious approach. In a recent VentureBeat article, Wilson argued for the opposite default setting, emphasizing the need for an "authorization gate outside the model." He posited, "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it," underscoring the critical distinction between proposing a change and autonomously executing it.
The Bottleneck Shifts: Visa Reimagines the Security Pipeline
Rajat Taneja, Visa’s President of Technology, vehemently rejects the notion that the default automated remediation poses an inherent risk, instead positioning it as the core product offering. "The bottleneck has moved," Taneja declared in an exclusive interview with VentureBeat. "AI is finding vulnerabilities faster than humans can in the history of our technology industry. The new bottleneck is fixing and proving we have fixed things." This perspective frames VVAH not as a risky shortcut, but as a necessary evolution to keep pace with the accelerated discovery of software flaws.
The genesis of VVAH can be traced back to Visa’s participation in Anthropic’s Project Glasswing. During this initiative, the company leveraged Anthropic’s Claude Mythos model to probe the vast network underpinning billions of daily transactions. The results were eye-opening, with the model adeptly chaining together seemingly minor weaknesses to construct functional exploits. VentureBeat previously covered this groundbreaking research in July, detailing how Visa employed Mythos to identify bugs within its own payment network before open-sourcing the harness that facilitated this process. "VVAH initially was completely only using Mythos, and that’s when all of us, as part of Project Glasswing, realized the power of this new class of models that does semantic reasoning," Taneja explained, emphasizing the transformative impact of these advanced AI models.
Since its public release on GitHub in June, VVAH has experienced remarkable adoption and acclaim. Its star count has surged from 595 stars and 97 forks on July 20 to over 2,300 stars and 300 forks as of August 25. Taneja highlighted an impressive clone-to-visitor ratio of approximately 9%, indicating a strong level of engagement and interest from the developer community. "We have got some very high-profile companies that have started using this harness," he noted, underscoring its appeal to major organizations.
The decision to open-source such a powerful tool stems from Visa’s deeply ingrained technology DNA and its foundational mission to "protect Visa and our ecosystem." However, Taneja emphasized a profound sense of obligation as a primary driver for this generosity. "To do good by doing right" for "companies who may not have the same level of investments or knowledge in cybersecurity" is a moral imperative that Visa embraces. Despite its open-source nature, the project currently operates on a one-way contribution model. The repository explicitly states that it is not accepting external code contributions, meaning the harness, while capable of editing adopters’ source code, does not incorporate external code into its own development.
The Thursday release signifies a significant expansion of the VVAH pipeline, extending its capabilities beyond mere reporting. "We’re going from discover, verify, and report, and then fix it, to discover it, verify it, remediate it, validate it, and iterate it," Taneja elaborated. "If a fix doesn’t negate the exploit, then there should be a structured, automated feedback that preserves the learnings from the first run and then enhances it." At the core of this enhanced loop, the system refactors its scanning process around an abstract syntax tree call graph. This graph meticulously maps subroutine calls and the traversal paths that an attacker could exploit. Taneja argued that this architectural change not only reduces token counts, thereby optimizing performance and cost, but also delivers "better reasoning, context, and better exploitability analysis." The release also introduces Mean Time to Adapt (MTTA) observability across all stages, providing a clear "window pane," as Taneja described it, with real-time progress views. He characterized the overall release as "a pretty good step function" in security automation.
One Metric, Three Definitions: Understanding Mean Time to Adapt
The Mean Time to Adapt (MTTA) metric, which Visa pioneered alongside the VVAH, receives a more streamlined definition in this latest release. The concise version defines MTTA as the duration between the discovery of an attack path and its resolution, with Visa claiming that some resolutions have been compressed from weeks to mere hours. However, Visa had previously published a more comprehensive definition in June. The Project Glasswing white paper outlines MTTA along three critical dimensions: inventory freshness, the number of exploitable paths per release, and the validation cycle time. The VVAH repository itself provides a third, elapsed time metric, measuring the interval from AI-discovered exploitability to a validated fix deployed in production. While board presentations may favor the shortest MTTA interval, Taneja strongly advises inquiring about all three dimensions. This is because a resolution count that omits the crucial validation step is precisely what MTTA was designed to replace, highlighting the importance of a complete and accurate assessment of remediation effectiveness.
Taneja ranks MTTA as "the most strategically important metric" because it fundamentally shifts the focus from the mere act of finding vulnerabilities to the enterprise’s capacity for rapid adaptation and remediation. His shorthand for this crucial concept is blunt: "It’s not the finding. It’s the fixing that matters." This emphasizes that the true measure of security effectiveness lies not in the ability to detect threats, but in the speed and efficacy with which those threats are neutralized.
The Default and the Gate: A Debate on Automation and Control
Steve Wilson’s argument extends beyond merely naming the need for a gate; he highlights the fundamental limitations of current AI security approaches. "We have to remember that security rules written inside prompts may shape the model’s behavior, but they are still suggestions to the model, not enforceable security controls," he wrote, underscoring the distinction between guidance and mandatory enforcement. He also candidly addressed the trade-offs involved in implementing stricter controls. "The tradeoff is that the agent loses the ability to improvise arbitrary, high-impact infrastructure changes on its own, while retaining autonomous investigation and routine, bounded remediation," Wilson stated, acknowledging the balance between enhanced security and operational flexibility.
The VVAH, in its default configuration, bypasses any explicit approval step between the generation of a patch and its application to the edited file. This fundamental aspect raised immediate questions for VentureBeat regarding the placement of human oversight in the process. Visa’s own June white paper provides a foundational principle: "AI agents are identities." This principle mandates scoped permissions, adherence to the principle of least privilege, robust audit trails, and comprehensive Identity and Access Management (IAM) governance for any agent that modifies a system. VVAH, in its shipped default configuration, embodies this principle by acting as such an AI agent.
"A lot of the traditional systems that are used today are basically signal providers," Taneja explained to VentureBeat. "They are telemetry, and then it’s a lot of human analysis, and your SOC and your security and incident response teams doing a lot of the heavy lifting when they respond." He contends that this model is unsustainable at the scale and speed required by modern cybersecurity challenges. He pointed to incidents like the Hugging Face breach and "other frontier models escaping sandboxes to do things more autonomously" as previews of what is to come. "We have seen the trailer of this movie," Taneja warned, adding, "and every company in the world should prepare and rethink their architecture."
The VVAH automates the adversarial step in the security process. Before a fix is considered validated, an adversarial panel rigorously assesses whether the patch effectively negates the exploit, which Taneja considers the ultimate test for completion. Failed fixes are then fed back into the system, initiating the "iterate" step that Taneja described. Stage 11, the final validation stage, operates in a read-only mode, as specified in the README. Crucially, VVAH does not compile, build, or run tests against the patched code tree at this stage. Taneja described this wrapper mechanism as "the governance architecture on top of that." He further argued that chaining individual findings into working exploits requires sophisticated threat modeling and a deep understanding of business context, which is why he believes "the harness with a model is far more effective than somebody using the model by itself."
Visa Addresses the Gate Question Directly
Following the interview, VentureBeat submitted written follow-up questions to Visa regarding the default automation and human gate placements. The company’s responses, received prior to publication, provided specific clarifications. Addressing the rationale behind enabling automated remediation by default, the company reiterated Taneja’s "bottleneck" argument and further narrowed the scope of VVAH’s intended use. "VVAH is meant for authorized operators running against code they own, and in a controlled environment," Visa stated in its written responses.
The question concerning the approval gate received the most detailed answer. "VVAH is a harness, not a merge tool," Visa emphasized. "Stage 10 writes candidate fixes to a working copy of the repo. Stage 11 then runs an adversarial validation panel that scores each fix and returns one of three verdicts: validated, validation failed or needs review. None of these bypasses your normal build, test, and code review flow." The company clarified that humans serve as "the gate in three places: Before running the tool. When reviewing the patches. And before anything gets merged." "The final call on any fix stays with the security and engineering teams. In an enterprise, trust and auditability are not optional. The default flow is built around that," Visa asserted, reinforcing its commitment to human oversight and established enterprise security practices.
When juxtaposed with Wilson’s proposed architecture, Visa’s approach aligns closely with his call for external gates, although the sequence differs. Wilson’s model emphasizes clearing an action before it is executed. The default VVAH configuration, however, incorporates human gates that are activated before the tool runs and again after the code has been written. The automated component is the attack simulation and remediation itself, with the three designated human gates situated outside the core AI model, effectively forming the boundary Wilson advocated for. "Our goal is to help security teams work at AI speed, not to replace them," Visa articulated. "VVAH does the repetitive parts. It finds issues, tests whether they are real, and proposes fixes. Before a fix gets to a human, an adversarial validation panel at stage eleven tries to break it. That way the human is spending time on decisions that need judgment, not on triaging noise."
Client zero, Visa itself, received direct confirmation of this operational posture. "VVAH runs against Visa code today," Visa confirmed. Taneja had previously volunteered this information during the call, stating, "We designed this and we were using it for ourselves, and we were client zero." He added, "only when we saw the impact and the positive effect of what we were finding, we said every company would need this." Visa further highlighted that adopters particularly value the context VVAH provides. By integrating data from Configuration Management Databases (CMDB), threat models, and business risk assessments, VVAH moves beyond simply identifying findings. It aims to answer the critical question: "’Which of these should you fix first, given how your business runs?’"
Model Choice Becomes a Per-Stage Decision
A significant architectural enhancement in the latest release is the introduction of multi-model orchestration. This allows for greater flexibility and optimization by enabling different AI models to be employed at various stages of the security pipeline. "Mythos has a very high recall, but the Opus model has very high precision," Taneja explained, illustrating the complementary strengths of different models. He framed the per-stage setup as follows: "On stage one I want to use this model. On stage two I want to use this model." This configuration can incorporate newer GPT releases and open-weight models, providing cost-effectiveness where pricing is a concern, all managed through configuration changes rather than extensive code modifications. "The whole is greater than the sum of the parts," Taneja summarized. He reiterated that the harness was designed to be model-agnostic from its inception, and this evolution has simply moved the model selection into the configuration layer, with prompt tuning and caching handled seamlessly underneath. One significant boundary has been moved: previously, applying a fix required Anthropic backends, while OpenAI-compatible backends were limited to reporting. The current README extends remediation and validation capabilities to OpenAI-compatible and open-weight models through a shared model-agnostic runtime. This eliminates any single provider as a hard dependency, although the default routing for both remediation and validation stages remains with Anthropic.
This newfound flexibility arrives in a rapidly evolving market. VentureBeat’s Q2 2026 Pulse research indicated that 59% of enterprises plan to adopt or switch agent security tooling within the next year, with 82% still relying on provider-native controls as their primary security layer. Visa’s announcement further solidifies its commitment to the open-source ecosystem, with contributions of VVAH to Nvidia’s Open Secure AI Alliance as a model-agnostic framework. Additionally, Visa is collaborating within Project Lightwell, IBM and Red Hat’s ambitious $5 billion initiative aimed at hardening open-source components.
Before Turning Fix Mode On: Essential Configuration Steps
To ensure responsible and secure implementation of the Visa Vulnerability Agentic Harness, particularly when enabling automated remediation, several critical decisions and configurations are paramount.
| Decision | What to Establish First
Visa’s latest announcement on Thursday marks a significant leap forward in automated cybersecurity, bolstered by an expansion of its Visa Consulting & Analytics advisory practice. The release of the Visa Vulnerability Agentic Harness (VVAH) with its comprehensive, end-to-end automation capabilities ships by default, meaning the entire loop—from vulnerability discovery to automated remediation and validation—is active unless intentionally disabled. This aggressive default setting comes just 18 days after Tenet Security’s stark demonstration of "GhostJacking" attacks at DEF CON 34. GhostJacking, a potent attack chain, highlighted the alarming potential of AI agents to read malicious payloads from log files and subsequently execute actions like rewriting DNS with valid credentials. This timing underscores the industry’s rapid response to emerging threats and the increasing reliance on AI-driven solutions.
In stark contrast to Visa’s default-on approach for automated fixing, prominent voices in the AI security community are advocating for more cautious implementation. Steve Wilson, Chief AI and Product Officer at Exabeam and a co-lead for the OWASP Top 10 for LLM Applications, articulated this viewpoint in a recent VentureBeat article. Wilson argued for a fundamental shift, stating, "The first thing I’d do is put an authorization gate outside the model." He elaborated, "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it." This perspective emphasizes the critical need for human approval before an AI agent can enact potentially impactful changes, a sentiment that Visa’s VVAH, in its default configuration, directly challenges.
The Bottleneck Moved, So Visa Moved the Pipeline
Rajat Taneja, Visa’s President of Technology, dismisses concerns about the default settings being a risk decision, asserting that this automation is the very essence of the product. "The bottleneck has moved," Taneja stated in an exclusive interview with VentureBeat. "AI is finding vulnerabilities faster than humans can in the history of our technology industry. The new bottleneck is fixing and proving we have fixed things." This statement encapsulates Visa’s strategic pivot: recognizing that the speed of vulnerability discovery has outpaced human capacity for remediation, they are leveraging AI to bridge this gap.
The genesis of VVAH lies in Visa’s participation in Anthropic’s Project Glasswing. During this collaboration, the company directed Anthropic’s Claude Mythos model to analyze the intricate network supporting billions of daily transactions. The experiment revealed the model’s potent ability to chain together minor security weaknesses into exploitable attack paths, a finding that VentureBeat reported on in July. "VVAH initially was completely only using Mythos, and that’s when all of us, as part of Project Glasswing, realized the power of this new class of models that does semantic reasoning," Taneja recalled, highlighting the profound impact of these advanced AI capabilities.
The harness’s journey to GitHub began in June, and its popularity has surged dramatically. As of August 25, it boasts over 2,300 stars and 300 forks, a significant leap from its 595 stars and 97 forks on July 20. Taneja noted a remarkable clone-to-visitor ratio of nearly 9%, indicating strong developer engagement. "We have got some very high-profile companies that have started using this harness," he revealed, underscoring its adoption by significant industry players.
Visa’s decision to open-source such a powerful tool stems from its core technological ethos and its mission "to protect Visa and our ecosystem." However, Taneja emphasized a strong sense of obligation as a primary motivation. "To do good by doing right" for "companies who may not have the same level of investments or knowledge in cybersecurity" is a guiding principle. Contribution to the VVAH project, however, currently runs in one direction. The repository explicitly states it is not accepting external code contributions, meaning the harness, while capable of editing adopters’ source code, does not integrate external code into its own development.
Thursday’s release extends the VVAH pipeline beyond simple detection and reporting. "We’re going from discover, verify, and report, and then fix it, to discover it, verify it, remediate it, validate it, and iterate it," Taneja explained. "If a fix doesn’t negate the exploit, then there should be a structured, automated feedback that preserves the learnings from the first run and then enhances it." Underpinning this enhanced loop, the release refactors scanning around an abstract syntax tree call graph, which maps subroutine calls and potential attacker traversal paths. Taneja argued that this architectural shift not only reduces token counts, improving efficiency and cost-effectiveness, but also delivers "better reasoning, context, and better exploitability analysis." The release also introduces Mean Time to Adapt (MTTA) observability across all stages, providing a transparent "window pane," as Taneja described it, with real-time progress views. He characterized the update as a "pretty good step function" in security automation.
One Metric, Three Definitions
The Mean Time to Adapt (MTTA) metric, which Visa invented alongside the harness, receives a more concise definition in this release. The simplified definition is the time elapsed between the discovery of an attack path and its resolution. Visa claims that some resolutions have been reduced from weeks to mere hours. In June, Visa published a broader interpretation of MTTA in the Project Glasswing white paper, which tracks the metric across three dimensions: inventory freshness, exploitable paths per release, and validation cycle time. The VVAH repository also details a third definition: the elapsed time from AI-discovered exploitability to a validated fix deployed in production. While board presentations may favor the shortest interval, Taneja strongly advises inquiring about all three dimensions, as a resolution count that omits validation is precisely what MTTA was designed to replace, highlighting the critical need for thorough verification.
Taneja considers MTTA "the most strategically important metric" because it shifts the focus from simply finding vulnerabilities to the speed and effectiveness with which an enterprise adapts and remediates. His shorthand for this concept is blunt: "It’s not the finding. It’s the fixing that matters." This emphasizes that true security maturity lies in the ability to rapidly and effectively address identified threats.
The Default and the Gate
Wilson’s argument extends beyond the mere identification of a necessary gate; he highlights the inherent limitations of current AI security models. "We have to remember that security rules written inside prompts may shape the model’s behavior, but they are still suggestions to the model, not enforceable security controls," he stated, underscoring that AI instructions are not absolute commands. He also pragmatically addressed the trade-offs involved: "The tradeoff is that the agent loses the
