Visa opens an 11-stage vulnerability agent

Visa released VVAH, an open-source security harness whose pipeline spans 11 stages and four phases for vulnerability discovery, remediation, and validation, according to its Apache 2.0 repository. The documentation warns that a default scan can modify source code, so the important deployment fact is that AI-assisted remediation still belongs behind a review gate rather than in an unattended CI path. Teams testing coding-agent security workflows can compare that boundary with Microsoft’s small-model security routing, but should treat VVAH as a harness to evaluate, not proof that autonomous patching is safe.