Visa’s VVAH Adds AI Patch Writing Across 11 Stages, Leaving Merge Decisions to Humans

Visa has turned its Vulnerability Agentic Harness from a system that finds and assesses software flaws into one that can write candidate fixes and challenge them before a human reviews the patch. The consequential boundary is that VVAH edits source files by default, but Visa says it does not merge changes or replace an organization’s normal build, test, and review flow.

A remediation loop, not just another scanner

The new workflow has 11 stages. It can detect a vulnerability, produce a candidate fix in a working copy of the repository, send that fix to an adversarial validation panel, and iterate when validation fails. Visa frames the shift as a response to a new bottleneck: moving from a finding to a fix that has been checked.

Visa first released VVAH in June after taking part in Anthropic’s Project Glasswing cybersecurity initiative. It says the harness is already used against Visa’s own code, where the company acted as its first internal client. The current release also broadens remediation and validation beyond Anthropic: OpenAI-compatible and open-weight models can use a shared model-agnostic runtime, though Anthropic remains the default route for both stages.

Validation is narrower than a release decision

Visa says VVAH is for authorized operators working on code they own in controlled environments. Its stage-11 panel returns one of three outcomes: validated, validation failed, or needs review. But that stage is read-only, and the harness does not compile, build, or run tests against the patched code tree. A “validated” result therefore assesses whether the proposed fix negates the exploit, not whether the change is ready for deployment.

The controls a team still has to supply

• Decide whether the harness may run in fix mode; operators can stop it at detection rather than allow source edits.
• Run the organization’s own build, test, code-review, and merge procedures after VVAH produces a candidate patch.
• Treat the stage-11 verdict as an exploit-focused validation signal, including its “needs review” outcome, rather than a substitute for release checks.

Visa pairs the tool with advisory services

The product release arrives alongside an expansion of Visa Consulting and Analytics’ cybersecurity practice. The new offerings include AI Cyber Leadership Education, a VVAH-informed cybersecurity maturity assessment, and a cyber-risk prioritization and roadmap service. Visa says the combined effort is intended to help clients assess risk, prioritize remediation, and strengthen resilience as AI shortens the time between vulnerability discovery and exploitation.

That makes the open-source harness more than a detection upgrade: it is a proposed operating model for patching at machine speed. Its practical test will be whether teams can use its automated remediation loop while preserving the controls needed to judge a code change beyond the exploit it was designed to close.