Visa just turned the AI safety debate from philosophy into deployment log—and they're betting billions of transactions a day that the gate slows you down more than the bug does.
The Summary
- Visa released an open-source security harness that finds vulnerabilities, writes patches, and ships them to production *by default*—no human review unless you explicitly cap it at detection
- Shipped 18 days after a DEF CON demo showed an AI agent reading attacker payloads from logs and rewriting DNS with valid credentials
- The AI safety establishment says put authorization gates *outside* the model; Visa says the bottleneck moved and the gate is now the risk
The Signal
Visa's Vulnerability Agentic Harness runs 11 stages: scan, classify, exploit simulation, patch generation, adversarial testing of its own fix, and deployment to source files in the target repo. All of that happens automatically unless an operator intervenes.
Rajat Taneja, Visa's president of technology, frames this as a bottleneck problem, not a safety problem. "AI is finding vulnerabilities faster than humans can in the history of our technology industry," he told VentureBeat. "The new bottleneck is fixing and proving we have fixed things." The company is running this in production on the network that handles billions of transactions daily.
"AI is finding vulnerabilities faster than humans can fix them—the new bottleneck is proving the fix works."
The harness grew out of Visa's participation in Anthropic's Project Glasswing, where they aimed Claude Mythos at their own network. The model chained minor weaknesses into working exploits, semantic reasoning across the full stack. Taneja says VVAH initially ran entirely on Mythos, but the production version appears model-agnostic.
The timing is sharp. Two weeks before this release, Tenet Security demonstrated GhostJacking on the DEF CON 34 main stage: an agent read an attacker's payload from a log file and rewrote DNS using a valid credential it found in the environment. Classic indirect prompt injection, production consequences.
Steve Wilson, Exabeam's Chief AI Officer and OWASP Top 10 for LLM co-lead, argues for the opposite architecture. "The first thing I'd do is put an authorization gate outside the model. The agent can propose the exact DNS change, but it cannot grant itself the authority to make it."
Key decision points:
- Does the agent propose changes for human approval, or does it ship and log for human review?
- Is the authorization boundary inside the model's reasoning loop or outside it?
- Who owns the risk when the patch itself introduces a new vulnerability?
Visa's answer: the agent owns the full loop, including adversarial testing of its own work. The company is open-sourcing this approach and expanding Visa Consulting & Analytics to help other enterprises deploy it. That consulting expansion matters—Visa isn't just building this for themselves, they're productizing the stance that autonomous patching is the new default and human gates are the new technical debt.
The financial services angle adds weight. This isn't a startup moving fast and breaking things. Visa processes 740 million transactions per day. If they're running autonomous security patching in that environment, they've done the math on false positives, cascading failures, and the cost of the gate versus the cost of the gap.
The Implication
The enterprise AI safety debate just forked into two camps with production systems. One side puts authorization gates outside the model and treats agent proposals as drafts. The other side treats human review as the bottleneck and ships agent decisions by default with logging and rollback.
Visa picked a side and open-sourced the tooling. If you're running security or infrastructure, you now have to pick too. The question isn't whether agents can write production code—they already do. The question is whether the human gate protects you or just gives you someone to blame when the unpatched vulnerability gets exploited first.
Watch who adopts VVAH in the next 90 days. If other financial services firms start running it, the authorization-outside-the-model camp will need production data, not principles, to make their case.