Visa Vulnerability Agentic Harness (VVAH): automated patching with human governance
venturebeat.com

Visa Vulnerability Agentic Harness (VVAH): automated patching with human governance

Tech News
2 min read

Published by AINave Editorial • Reviewed by Ramit

TL;DRVisa released the open-source Visa Vulnerability Agentic Harness (VVAH) that automatically finds, patches, and validates code vulnerabilities with an adversarial panel, while preserving human review at three gates. For AI builders, it demonstrates model-agnostic multi-model orchestration and a shift from finding to fixing as the security bottleneck.

Visa released the open-source Visa Vulnerability Agentic Harness (VVAH), a security pipeline that automatically finds vulnerabilities, writes patches, and runs an adversarial validation panel before any human reviews the fix. The harness keeps three human gates in place, but the default runs all 11 stages and edits source files unless capped at detection. For AI builders, VVAH is a practical example of model-agnostic multi-model orchestration and a shift in security metrics from discovery speed to remediation speed.

The 11-stage pipeline: from detection to adversarial validation

VVAH grew out of Visa's participation in Anthropic's Project Glasswing, where the company aimed Claude Mythos at its payment network and watched the model chain minor weaknesses into working exploits. The harness now extends that capability into a full remediation loop. Stage 10 writes candidate fixes to a working copy of the repo. Stage 11 then runs an adversarial validation panel that scores each fix and returns one of three verdicts: validated, validation failed, or needs review. None of these bypasses your normal build, test, and code review flow, according to Visa. The pipeline also refactors scanning around an abstract syntax tree call graph that maps subroutine calls and attacker traversal paths, which Visa says cuts token counts while

Sources

Latest Tech News