Visa (NYSE: V) has broadened its open-source AI cybersecurity framework, moving the tool from finding weaknesses to proposing and checking fixes in a single governed workflow. The payment network said the latest Visa Vulnerability Agentic Harness (VVAH) is meant to shrink the gap between spotting an attack path and closing it, in some cases from weeks to hours.
The framework first appeared in June 2026 after Visa took part in Anthropic’s Project Glasswing, a program that used frontier models to hunt software flaws at machine speed.
That earlier release focused on discovery, exploitability review, and structured reporting.
The new version extends the same pipeline into closed-loop remediation and validation, so teams can refine a failed patch without starting the entire process again.
VVAH is model-agnostic by design.
Operators can point it at approved Anthropic models, OpenAI-compatible systems, or other models through configuration rather than rewriting code.
Optional live progress views give visibility into long-running scans and repair jobs.
Visa also stresses human-in-the-loop controls at high-risk steps, framing the product as a harness that directs AI rather than a scanner that acts without oversight.
Findings can be exported in SARIF-compatible form so they land in existing developer and security operations tools.
Company executives argue that AI has compressed the window between disclosure and exploitation.
Rajat Taneja, Visa’s president of technology, said defenders now need a faster, more reliable path from insight to a validated fix.
Carl Rutstein, who leads Visa Consulting & Analytics, put it more bluntly: finding bugs is no longer the hardest part; speed of repair is.
That consulting arm is expanding in parallel with the software release.
New offerings include executive education on AI-era cyber risk, maturity assessments informed by VVAH, and roadmap work that helps clients rank which attack paths to close first.
Adoption of the open-source project has grown quickly. Visa said tens of thousands of developers have downloaded VVAH since June.
The company is also contributing the framework to NVIDIA’s Open Secure AI Alliance as a model-independent reference and is collaborating through IBM and Red Hat’s Project Lightwell to harden widely used open-source components.
GitHub activity reported in coverage of the announcement showed the repository climbing well past two thousand stars in the weeks after the first public drop.
The timing reflects a broader industry worry. Autonomous agents can chain small flaws into working exploits faster than traditional red teams.
Visa’s own earlier tests with advanced models reportedly surfaced complex paths across payment-related infrastructure that conventional tools might have caught only late in a penetration exercise.
The company now treats time-to-adapt—how quickly a known path is closed—as a more useful metric than older remediation clocks.
None of this is sold as a turnkey product.
Visa presents VVAH as a reference implementation that security teams can inspect, adapt, and run under their own policies. Operators can still cap a run at detection if they do not want automated file edits.
That caution is deliberate: an agent that writes patches into a live repository needs tight governance, logging, and the option to stop. For banks, merchants, and software teams facing AI-accelerated attackers, the update is less a new scanner than an attempt to industrialize the last mile of defense—verify, patch, prove the patch held, and iterate if it did not.