Visa Vulnerability Agentic Harness (VVAH)

What it is

VVAH is Visa's open-source LLM harness for autonomous vulnerability discovery, remediation, and validation, built on learnings from Project Glasswing (Anthropic's AI-assisted vulnerability research initiative). The summary covers the pipeline breadth; what matters for acting is that the shipped default profile stops after Phase 3 (S9) — remediation and validation (S10–S11) are optional and disabled unless you enable them, and the new exploit-verification stage is off by default and heavily fenced.

How it works

The stages group into four phases: Discovery & Modeling (S1–S3), Deep Dive & Verification (S4–S6), Synthesis & Reporting (S7–S9), and optional Remediation & Validation (S10–S11). Seeding differs by profile: default.yaml and full.yaml derive the S0 seed from the model; taint.yaml uses rules mode and requires operator-supplied source/sink YAML. Exploit verification (S6) attacks a candidate finding with real HTTP traffic to prove exploitability, attaching evidence instead of waiting on manual reproduction. It is additive and positive-only — it never drops a finding, and the static verifier keeps the verdict.

Preconditions / Affected

• Interprocedural taint analysis covers Python/Java/C# ("supported application languages").
• Exploit verification is Beta, API-only, localhost-only, and off unless EV_API_COLLECTION is set.
• Any role routed via cli, sdk, openai, or deepagents sends prompt data to that provider endpoint (Anthropic/OpenAI or your gateway) — a real data-egress consideration for proprietary code.
• Authorized use only: scan targets you own or have explicit permission to test.

What to do

• To get remediation/validation, explicitly enable S10–S11; the default profile does not run them.
• Regression-test a fix with the exploit that found the bug:

vvaharness ev-replay

• Validate a collection and target with no model spend:

--stop-after ev

• Provide EV auth only through EV_AUTH_* environment variables — never a profile or CLI flag. Be aware other secrets can still reach the target on the wire: tokens saved inside collection requests, EV_TARGET_CLIENT_KEY_PASSPHRASE, and any hardcoded credential the attacker agent finds in the repo and replays.

Caveats

• Findings and fixes are LLM-generated triage candidates requiring human review.
• The coverage backstop for unrecognized files is best-effort, not a guarantee (see docs/security.md).
• The repo is not accepting external code contributions; GitHub Issues are open for bugs/docs/setup/feature requests only.
• The design premise is that triage speed, not discovery, is the bottleneck — the primary metric is Mean Time to Adapt (MTTA), elapsed time from AI-discovered exploitability to a validated fix in production.