visa/visa-vulnerability-agentic-harness

Visa Vulnerability Agentic Harness

What it solves

Traditional Static Analysis Security Testing (SAST) tools often generate a high volume of findings that require manual triage, reproduction, and verification. VVAH reduces the Mean Time to Adapt (MTTA) by automating the discovery, adversarial verification, remediation, and validation of vulnerabilities in source code, moving the process from weeks to hours.

How it works

VVAH operates as an agentic pipeline consisting of three main phases:

  1. Discover (S0–S9): This phase uses a combination of deterministic stages (pattern matching and code graph analysis) and agentic stages (threat modeling and adversarial verification). It builds a code graph of symbols, calls, and imports to query the code's structure without needing constant model calls.
  2. Remediate (S10): The pipeline applies minimal fixes to the source code or proposes them in a report-only mode.
  3. Validate (S11): An independent panel of three adversarial reviewer personas grades the proposed fixes to ensure they are effective.

The system is model-agnostic, supporting Anthropic and any OpenAI-compatible endpoint, including open-weight models.

Who it’s for

Security researchers, application security teams, and developers who need to automate the vulnerability lifecycle from detection to validated fix.

Highlights

  • Adversarial Verification: Verifies findings against the code and provides evidence such as exploit scenarios and preconditions.
  • Pluggable Code Graph: Uses a deterministic map of the code to provide context to agents without increasing token spend.
  • Security Playbooks: Includes 17 specialist skills for different weakness families (e.g., injection, CSRF, SSRF) to ensure high-quality findings.
  • External Scanner Integration: Can act as a verification and reporting layer for existing scanners (like Semgrep) via an SDK.
  • Exploit Verification (Beta): Provides optional live HTTP evidence that a finding is exploitable on a local API.
  • Multi-model Support: No single provider dependency, allowing the use of various LLM providers.

Related

  • Project
    knostic/OpenAnt

    OpenAnt (knostic/OpenAnt) is a genuine open-source software project that applies LLMs to security: it scans code repositories to find and verify vulnerabilities, and can generate and vet trusted patches. It's a practical, system-level tool with a CLI, configurable LLM adapters, and a web UI — not a list or tutorial.

  • Project
    xalgorix/xalgorix

    Xalgorix is an open‑source, self‑hosted AI‑driven penetration‑testing platform. An autonomous LLM agent runs a 22‑phase methodology, then a separate verifier re‑exploits each finding, delivering exploit‑verified results. Users bring their own LLM API key, run the tool via binary, Go install, Docker, or source build, and interact through a local web UI or API. Features include a bundled offensive‑security toolset, live telemetry, PDF reports, CI/CD GitHub‑App integration, and optional hosted SaaS. Licensed under Apache 2.0.

  • Project
    capitalone/VulnHunter

    An agentic AI security tool that identifies exploitable vulnerabilities in source code by simulating attacker paths and using a falsification engine to minimize false positives.

  • Project
    deonmenezes/mantishack

    An autonomous AI agent for ethical hacking that uses a detect-then-validate pipeline to discover and prove the reachability of software vulnerabilities.

  • Project
    gadievron/raptor

    An autonomous security research framework that chains static analysis, binary analysis, and LLM-powered validation to discover and patch vulnerabilities.