Visa Vulnerability Agentic Harness (VVAH)

Visa’s open-source harness for autonomous vulnerability discovery, remediation and validation using frontier models. Apache-2.0, created 5 June 2026, last pushed 3 July, v1.1.0, Python ≥3.10, output in Markdown and SARIF 2.1.0. 1,889 stars and 230 forks when read on 2026-07-29. T1 — the artifact itself, with its own limitations section. Built on learnings from project-glasswing; reported in visa-mythos-glasswing.

Four phases, eleven stages

A governed pipeline rather than a scanner. Discovery and modeling (S1–S3) maps the attack surface and builds a threat-aware plan; deep dive and verification (S4–S6) runs multi-lens analysis and adversarial verification of exploitability; synthesis and reporting (S7–S9) deduplicates, chains and emits SARIF; remediation and validation (S10–S11) proposes fixes and attacks them before adoption.

Each LLM-driven stage is a composable skill that can be tuned, versioned and replaced without rewiring the pipeline — an attack-surface mapper, a STRIDE/OWASP threat modeler, specialised research lenses (language, crypto, logic-bug, access-control, batch/ETL, IaC), an adversarial reviewer, a deduplicator, an exploit strategist, remediation playbooks per CWE–language–framework triple, and an S11 validation panel of security-architect, penetration-tester and an optional cross-repo-analyzer scoring fixes against weighted gates. S9 is fully deterministic and has no skill.

Three stated design choices drive quality: threat modeling before analysis to focus the surface, multi-agent deterministic voting requiring convergence across independent reasoning chains before a finding advances, and structured triage artifacts to compress the path from finding to shippable fix.

The sentence that matters to this spoke

“The bottleneck in AI-assisted vulnerability management is triage speed, not discovery.”

The whole architecture follows from it, including the primary metric — mean-time-to-adapt, elapsed time from AI-discovered exploitability to a validated fix in production. Every other source in this spoke has treated discovery speed as the thing AI changed. Visa built its pipeline on the opposite premise, and so did Anthropic independently (project-glasswing). Recorded as a direct tension with akrites-oss-ai-threats in synthesis.

What it admits about itself

The limitations section is unusually direct for a corporate release, and three items carry weight:

• “No published accuracy numbers yet. Precision/recall figures are not yet published.” A vulnerability tool shipping without precision or recall, and saying so in its README.
• LLM-generated and non-deterministic. Findings and fixes are triage candidates, not confirmed vulnerabilities or production-ready patches; two runs may differ. Majority-vote false-positive filtering runs only on the sdk and openai backends — the cli backend has no temperature control and always runs single-pass.
• It does not build or test what it patches. “VVAH does not compile, build, or run tests against the patched tree.” And the shipped default profile runs all eleven stages, which edits source files in the target repo unless the operator passes --stop-after s9. A security tool whose default behaviour is to modify your code with unvalidated patches.

Also disclosed: it runs with elevated privilege, and running it against untrusted input “may expose host credentials, API keys, and sensitive files” — the tool inherits the trust boundary problem this spoke keeps meeting (openai-huggingface-incident, exploitgym-repo).

Vendor neutrality, with an asterisk

Multi-model by design through a vendor-neutral abstraction layer — Anthropic Claude, OpenAI-compatible models, or both. But validation (S11) is Anthropic-only and remediation fix mode is effectively Anthropic-only, because applying a fix needs the file-mutation tools (Edit/Write) that only the Anthropic backends expose; the OpenAI-compatible backend is sandboxed to Read/Glob/Grep and an OpenAI remediation role can only run --mode report-only. The abstraction layer is real at the control plane and thins out at exactly the stage that changes code.

The repository is not accepting external code contributions, which makes “open source” here a published reference implementation rather than a collaborative project.

Related

visa-mythos-glasswing · project-glasswing · mean-time-to-adapt · visa · akrites-oss-ai-threats · exploitgym-repo · defensive-security · synthesis