[Digital Today reporter Chi-gyu Hwang (황치규)] Visa is automatically handling everything from vulnerability detection to fixes and verification without human review through its open-source security tool VVAH (Visa Vulnerability Agentic Harness), VentureBeat reported on Aug. 27 (local time).

VVAH runs 11 steps by default and directly modifies source code in repositories unless an operator sets restrictions, the report said.

VVAH began as Visa joined Anthropic’s Project Glasswing, the report said.

After being posted on GitHub in June, VVAH had 595 stars as of July 20 and surpassed 2,300 on Aug. 25.

VVAH must pass an 11th step in which an adversarial verification panel evaluates the proposed fix, after going through a 10th step that records candidate changes in a working copy.

Visa explained that human involvement occurs at three points: before execution, during patch review and before merging. The company said final decisions on all changes remain with the security and engineering team.

Rajat Taneja (라자트 타네자), Visa’s chief technology officer, said, "As AI finds vulnerabilities faster than people, the bottleneck is shifting. Now the bottleneck is fixing them and proving they were fixed."

VVAH supports OpenAI-compatible models and open-weight models, but its default routing remains an Anthropic model. Taneja said, "Mythos has high recall and Opus has high precision," adding, "We place different models by stage."