Visa Unveils AI Security System that Automatically Updates Production Code Without Human Oversight
Visa has introduced an open-source security tool that autonomously identifies vulnerabilities, applies fixes, and conducts self-assessments of its own patches without requiring prior human intervention. This entire process operates by default, executing all 11 steps of the Visa Vulnerability Agentic Harness (VVAH) and modifying source files in the repository, unless limited to just detection by the operator.
This announcement coincides with an expansion of the Visa Consulting & Analytics advisory group and comes shortly after Tenet Security showcased a vulnerability, termed GhostJacking, at DEF CON 34. This attack method involved an agent extracting an attacker’s payload from a log and modifying DNS settings using valid credentials. In contrast, Steve Wilson, Chief AI and Product Officer at Exabeam, advocated for a more cautious approach just days prior, suggesting an authorization gate outside the model to prevent unauthorized changes.
Adapting to the New Reality
Rajat Taneja, Visa’s president of technology, asserts that this tool is not a risk-laden default but an essential product. He emphasized that as AI detects vulnerabilities more swiftly than humans have ever managed, the new challenge lies in remedying these vulnerabilities efficiently. This project stemmed from Visa’s involvement in Anthropic’s Project Glasswing, where the AI model identified vulnerabilities in the networks processing billions of transactions daily. Taneja noted that initial trials using the model revealed its significant capabilities in semantic reasoning.
Since its debut on GitHub in June, VVAH has gained traction, rising from 595 stars and 97 forks to over 2,300 stars and 300 forks by late August. Taneja revealed that several prominent companies have begun utilizing this tool, which was designed fundamentally to safeguard Visa and its broader ecosystem. His motivation for sharing it lies in a commitment to assist companies lacking substantial resources or expertise in cybersecurity.
Currently, the repository does not accept external code contributions, ensuring that the tool modifies users’ code without incorporating any outside input.
The recent update enhances the software pipeline beyond just reporting by incorporating discovery, verification, remediation, validation, and iterative feedback. Taneja explained that if a fix does not eliminate the vulnerability, the tool will learn from the initial attempt, thereby improving future efforts. The underlying changes also optimize scanning with a call graph that helps evaluate potential attack paths and vulnerabilities.
Revolutionizing Metrics
Visa introduced a new metric, Mean Time to Adapt (MTTA), which defines the period between the discovery of an attack path and its resolution. This turnaround time has significantly decreased for some vulnerabilities, according to Visa, from weeks to mere hours. In a broader context, MTTA considers variables like inventory freshness and validation cycles, making it essential for measuring efficiency in cybersecurity response.
Taneja emphasized that MTTA focuses more on rapid adaptation rather than just detection of issues. “It’s not about finding problems; it’s about fixing them,” he asserted.
Automation versus Human Oversight
Visa clarified that its tool operates without human approval between the patch application and the edited file. They reiterated that VVAH serves authorized users and is designed for implementation within controlled environments.
The company’s standards require that any modifications made by AI agents must adhere to strict governance practices. These ensure permissions, audit trails, and identity governance for every agent interacting with a system. As Taneja pointed out, relying solely on traditional systems consisting of human analysis cannot meet today’s demands, especially given the rise of autonomous models presenting new challenges.
The Importance of Human Gates
In response to questions from the media, Visa reiterated that human oversight is embedded at various stages: before initiating the tool, reviewing patches, and before final mergers. “The ultimate decision on adjustments remains with the security and engineering teams,” they emphasized, stressing that trust and auditability are crucial in enterprise environments.
Client interactions reaffirmed that VVAH has been effective for Visa’s own code, reinforcing confidence in its utility among external adopters. The tool focuses on contextualizing vulnerabilities—integrating data from various sources to prioritize issues based on business operations.
Stage-Based Model Selection
Visa incorporated a multi-model orchestration approach, enabling different models to be applied at various stages of the process. Taneja explained the choice of models based on their strengths, allowing flexibility and adaptation to different requirements throughout the remediation and validation processes.
As enterprises increasingly look to enhance their security frameworks, Visa is contributing VVAH to broader industry initiatives aimed at fortifying open-source components. The company’s consulting services will also expand, offering maturity assessments and strategies to help clients manage vulnerabilities more effectively.
