Visa Open-Sources VVAH: AI-Powered Vulnerability Discovery and Remediation Tool Built on Anthropic's Project Glasswing
Key Takeaways
- ▸Visa open-sources VVAH, an agentic pipeline for autonomous vulnerability discovery, remediation, and validation using frontier AI models
- ▸Four-phase, eleven-stage pipeline combines threat modeling, multi-agent verification, and adversarial validation to reduce false positives and accelerate time-to-production-fix
- ▸Built on Anthropic's Project Glasswing research with multi-model support (Anthropic Claude, OpenAI-compatible) but requires Anthropic models for full remediation and validation capabilities
Summary
Visa has open-sourced Vulnerability Agentic Harness (VVAH), an autonomous vulnerability discovery, remediation, and validation system built on learnings from Anthropic's Project Glasswing initiative for AI-assisted vulnerability research. VVAH operates as a four-phase, eleven-stage pipeline that discovers vulnerabilities, validates their exploitability through adversarial verification, generates remediation candidates, and validates proposed fixes before deployment—all using frontier AI models including Anthropic's Claude and OpenAI-compatible systems.
The system's architecture emphasizes finding quality through three key design choices: threat modeling to focus the attack surface, multi-agent deterministic voting to reduce false positives, and structured triage artifacts to compress the AI-to-production cycle. Rather than optimizing for raw detection volume, VVAH's primary effectiveness metric is Mean Time to Adapt (MTTA)—the elapsed time from AI-discovered exploitability to a validated fix in production—reflecting a focus on triage speed as the actual bottleneck in AI-assisted vulnerability management.
VVAH is multi-model by design and works with Anthropic Claude, OpenAI-compatible models, or combinations thereof via a vendor-neutral abstraction layer. While no single provider is a hard dependency, current remediation and validation capabilities are fully realized with Anthropic models. The tool ships with comprehensive documentation and integrates standardized inputs from multiple sources including batch repositories, GitHub Enterprise metadata, and CVE feeds, producing structured reports in Markdown and SARIF formats.
- Optimizes for Mean Time to Adapt (MTTA)—recognizing that triage speed, not raw detection volume, is the bottleneck in production vulnerability management
Editorial Opinion
This release signals that production-grade AI-assisted security is maturing from research into enterprise tooling. By open-sourcing VVAH and anchoring it on Anthropic's Project Glasswing, Visa validates the real-world utility of frontier AI models in high-stakes security contexts while creating an industry standard. The emphasis on deterministic multi-agent voting and adversarial validation over raw model outputs reflects hard-won lessons about deploying AI reliably at scale. This is how security-critical industries should adopt frontier models: with transparency, multi-provider flexibility, and metrics optimized for human outcomes like time-to-fix.
