Visa’s AI Security Solution: Patching Production Code Before Human Review
Visa has unveiled an innovative security AI solution that patches production code before any human review, marking a significant advancement in cybersecurity. This open-source security harness is designed to identify vulnerabilities, write fixes, and implement its own patches, all without human intervention.
Key Features and Announcements:
- Visa Vulnerability Agentic Harness (VVAH): This harness runs through 11 stages and automatically edits source files in the target repository, unless restricted by the operator.
- Default Settings: Visa is shipping this default within 18 days of a demonstration highlighting a potential attack vector, GhostJacking, at DEF CON 34.
- Expert Opinions: Steve Wilson, Chief AI and Product Officer at Exabeam, advocated for an authorization gate outside the model to prevent unauthorized actions.
- Shifting Bottlenecks: Rajat Taneja, Visa’s President of Technology, argues that the bottleneck is now moving from vulnerability discovery to fix implementation, emphasizing the need for a new approach.
- Project Glasswing Origins: VVAH evolved from Visa’s participation in Anthropic’s Project Glasswing, where they utilized Claude Mythos to identify network weaknesses.
- GitHub Presence: The harness gained significant traction on GitHub, growing from 595 stars and 97 forks to over 2,300 stars and 300 forks within a few months.
- Share and Obligation: Visa chose to share this technology to protect its ecosystem and contribute to better cybersecurity for companies with varying resources.
- Extended Pipeline: The release expands beyond reporting, incorporating discover, verify, remediate, validate, and iterate stages for continuous improvement.
- Refactored Scanning: The new harness refines scanning techniques using an abstract syntax tree call graph, enhancing exploitability analysis while reducing token counts.
- MTTA (Mean Time to Adapt): The release includes observability features, providing real-time progress views and a structured feedback loop for continuous learning and improvement.
