Visa has released the Visa Vulnerability Agentic Harness as an open-source reference implementation for AI-powered vulnerability management. The system is part of Visa’s work with Anthropic’s Project Glasswing, a defensive cybersecurity initiative used to test advanced AI against the company’s security environment. Visa says the fifth generation of its multi-model security test suite maps its codebase, deploys AI agents to find vulnerabilities, classifies and prioritizes findings, and produces reports for developers and remediation agents. Newer updates extend the workflow beyond discovery to remediation and patch validation. Human oversight remains required: security and engineering teams review findings, confirm severity, and choose remediation paths, while validation agents can then address and check fixes. Visa says the system can interpret plain-language objectives, adapt as systems change, and operate continuously without manual script maintenance. The company reports that testing found new vulnerabilities, including issues deep in the software stack and risks that could become more serious when chained together, but its zero-trust controls, network segmentation, and other safeguards would have blocked exploitation of the critical findings examined. Visa argues that AI has shifted the key metric from time to detect toward “Mean Time to Adapt,” covering confirmation, remediation, and proof that an attack path is closed. It also highlights rising supply-chain risk from open-source and third-party software, and says it is pursuing AI-assisted validation and coordinated patching with industry partners. Visa’s next priorities are reducing vulnerabilities earlier in development, replacing high-risk dependencies, and making detection, validation, and response more autonomous under clear human governance. The article notes that Anthropic’s initial Project Glasswing update reported more than 10,000 high- or critical-severity vulnerabilities identified across widely used, systemically important software during the initiative’s first month.
