Visa Expands Open-Source VVAH From Vulnerability Discovery to Remediation

Visa extends VVAH from finding vulnerabilities to fixing and validating them

Visa announced on August 27, 2026 an expanded release of its Visa Vulnerability Agentic Harness (VVAH), an open-source, model-agnostic framework for AI-assisted vulnerability management.

VVAH was originally open-sourced in June after Visa's participation in Anthropic's Project Glasswing. The new release is therefore not the first appearance of the framework. The material change is that the workflow now extends beyond discovery and triage into remediation and validation.

What's new in the latest release

Visa describes three main additions:

• Closed-loop remediation: if a proposed fix fails validation, structured feedback can be used to refine the remediation without restarting the entire process.
• Flexible model choice: approved Anthropic and OpenAI models can be used, while other models can be configured without code changes.
• Progress visibility: optional real-time views can expose the status of longer-running scan and remediation workflows.

The intended end-to-end flow is discovery, triage, remediation and validation inside one structured system.

The performance claim needs context

Visa says the approach can reduce what it calls Mean Time to Adapt (MTTA)—the time between discovery and resolution of attack paths—and says some resolutions have shrunk from weeks to hours.

That is a Visa-reported operational claim, not an independent benchmark or a guarantee for other environments. Results will depend on codebase complexity, model choice, security controls, review processes and the kinds of vulnerabilities being tested.

Visa also says VVAH has been downloaded by tens of thousands of developers since its June open-source release. That figure comes from Visa's announcement.

Human oversight remains part of the design

Visa's accompanying technical material says human oversight remains essential at key stages. Security and engineering teams review findings, validate severity and determine remediation paths before changes advance, while patch-validation agents are used to test whether fixes close the relevant attack path.

That distinction is important. VVAH is not presented as a reason to let autonomous agents make unrestricted changes to production systems.

The framework should be used only in systems and codebases where the operator has authorization to test, and organizations still need access controls, review gates, logging and rollback procedures around AI-generated changes.

Why it matters

AI-assisted security is moving from one-shot vulnerability detection toward closed-loop defensive workflows that can reason about findings, propose fixes and then test whether the fix actually worked.

VVAH is notable because Visa is releasing the framework as open source and keeping the model layer configurable rather than tying the workflow to one foundation-model provider. Visa is also contributing VVAH through broader security initiatives including NVIDIA's Open Secure AI Alliance and work around IBM and Red Hat's Project Lightwell.

The new release is best understood as a developer/security tooling update—not as a new frontier model. Its value will depend on how safely and reliably teams can integrate agentic remediation into existing AppSec and software-delivery controls.