Visa has released VVAH (Visa Vulnerability Agentic Harness) — an open-source AI-based tool designed for the automated detection, patching, and validation of software vulnerabilities.
What Happened
Visa introduced VVAH, which consists of an 11-stage agentic pipeline. The system includes phases for attack planning, deep analysis, patch generation, and subsequent verification via an agentic "adversarial panel." The architecture supports various models, including Claude, OpenAI, and local LLMs, through an abstraction layer, and utilizes multi-agent voting to minimize false positives.
Context
The development is based on the principles of Anthropic's Project Glasswing. The tool marks a transition from traditional Static Application Security Testing (SAST) to the concept of Agentic SAST, where the focus shifts from simple problem detection to creating automated code self-healing loops.
Why It Matters for the Industry
For the cybersecurity industry, this means a radical reduction in MTTA (Mean Time to Adapt) — the time required to implement a verified fix after a threat is discovered. The emergence of a high-quality open-source framework from a major player sets a new standard for remediation automation and provides a foundation for developing multi-agent systems in DevSecOps.
Why It Matters for Users
Developers and security engineers gain access to an advanced tool that allows them to integrate automated remediation methods into their workflows. This enables engineering roles to shift their focus from routine error searching to overseeing automated security systems.
What Is Not Yet Known / Limitations
The full remediation cycle may depend on the performance of the models used (e.g., Anthropic). Additionally, using third-party LLMs raises questions regarding legal liability for generated code and compliance.
Sources
Author
Look at AI, Editorial Team