Visa ships a security AI that patches production code before any human reviews it

In a significant leap for cybersecurity, Visa has introduced an AI-driven tool that automates the patching of vulnerabilities in production code. This innovation, the Visa Vulnerability Agentic Harness (VVAH), scans, identifies, and even fixes issues without any prior human review. While this could streamline the often tedious process of vulnerability management, it raises important questions about trust, oversight, and the potential for unchecked automation.

Visa security AI and its implications

The VVAH operates by running a series of eleven automated stages, significantly reducing the time needed to resolve vulnerabilities. Visa’s president of technology, Rajat Taneja, emphasized that the bottleneck has shifted from discovery to remediation. However, the absence of a human approval step before deploying fixes can be concerning. Critics, like Steve Wilson from Exabeam, argue for a more cautious approach, advocating for human gates to oversee such critical changes.

Moreover, this tool stems from Visa's collaboration with Anthropic’s Project Glasswing, leveraging advanced AI models to enhance security. This evolution showcases a trend where companies increasingly rely on AI to tackle complex security challenges. Yet, while the automation of these processes holds promise, the implications for accountability and control cannot be overlooked.

Ultimately, the launch of the VVAH represents a noteworthy advancement in the intersection of AI and cybersecurity. As organizations consider adopting similar technologies, they must weigh the benefits against the risks of ceding too much control to automated systems. The conversation around security and AI will only grow more critical in the coming years.