GoKawiilVisa releases open-source AI tool that auto-patches vulnerabilities without human review by default
Visa has open-sourced the Vulnerability Agentic Harness, an 11-stage AI pipeline that detects security flaws, writes fixes, and adversarially tests its own patches in production code, with autonomous patching enabled by default unless an operator restricts it to detection only. The release comes alongside an expanded Visa Consulting & Analytics advisory practice and follows Visa's earlier work with Anthropic's Claude models under Project Glasswing.
GoKawiil's interpretation of the reporting above, not reported fact.
The default arrives just 18 days after security researchers publicly demonstrated an attack where an AI agent was manipulated into rewriting DNS records using a stolen credential, raising concerns that autonomous code-editing agents could be similarly hijacked. Visa's technology chief argues the AI-driven flaw discovery has outpaced human remediation capacity, justifying automated fixes, but critics like OWASP's Steve Wilson argue authorization gates outside the model are essential before agents get authority to make changes themselves.
- Visa's VVAH tool runs 11 stages that find, fix, and self-test vulnerabilities without mandatory human review before deployment.
- The release follows a demonstrated attack (GhostJacking) where an AI agent was tricked into making unauthorized DNS changes.
- Visa frames the shift as necessary because AI now finds vulnerabilities faster than humans can verify and fix them, moving the security bottleneck.
O'Reilly "Building Secure and Reliable Systems" book — If Visa's auto-patching harness has you thinking hard about where humans belong in a security pipeline, this Google-authored O'Reilly volume is a great grounding read on designing systems with review gates, least privilege and safe defaults. It's a practical companion for anyone weighing autonomous fixes against authorization boundaries like the ones OWASP folks argue for.
See O'Reilly "Building Secure and Reliable Systems" book on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: venturebeat.com, 2026-08-27
Published there as: “Visa ships a security AI that patches production code before any human reviews it”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.