visa/visa-vulnerability-agentic-harness

What it solves

Visa Vulnerability Agentic Harness (VVAH) is an autonomous pipeline for discovering, remediating, and validating security vulnerabilities in source code. It addresses the bottleneck of triage speed in AI-assisted vulnerability management by automating the path from initial discovery to a validated fix.

How it works

VVAH operates as an eleven-stage pipeline divided into four phases:

1. Discovery & Modeling (S1–S3): Maps the attack surface and creates a threat-aware plan using threat modeling (STRIDE, OWASP).
2. Deep Dive & Verification (S4–S6): Performs multi-lens analysis (e.g., crypto, logic-bugs, access control) and adversarial verification to confirm if a vulnerability is actually exploitable.
3. Synthesis & Reporting (S7–S9): Deduplicates findings and chains them into structured reports in Markdown and SARIF formats.
4. Remediation & Validation (S10–S11): Proposes and applies candidate fixes, which are then graded by an agentic adversarial panel (security architect, penetration tester) to ensure the fix is effective.

To improve accuracy, the system uses tree-sitter for static AST/call-graph seeding and a majority-vote filtering system to reduce false positives.

Who it’s for

Security researchers and AppSec teams who want to automate the discovery and patching of vulnerabilities in their own codebases using frontier AI models.

Highlights

• End-to-End Automation: Covers the entire lifecycle from discovery to validated remediation.
• Multi-Model Support: Compatible with Anthropic Claude and OpenAI-compatible models via a vendor-neutral abstraction layer.
• Specialized Analysis Lenses: Includes six cross-cutting lenses for specific vulnerability types like IaC and deserialization.
• Taint Analysis: Supports interprocedural data-flow tracking for Python, Java, and C#.
• Adversarial Validation: Uses a panel of AI agents to stress-test proposed fixes before they are adopted.