Visa Vulnerability Agentic Harness

Visa Vulnerability Agentic Harness (VVAH) is Visa's open-source harness for autonomous vulnerability discovery, remediation, and validation using large language models, building on learnings from an Anthropic initiative for AI-assisted vulnerability research. It runs a four-phase pipeline: discovery and threat modeling, deep-dive analysis with adversarial verification, synthesis into deduplicated Markdown and SARIF findings, and an optional remediation and validation phase that proposes and adversarially checks candidate fixes.

Its design emphasizes threat modeling before analysis to focus the search, multi-agent deterministic voting to reduce false positives, and structured triage artifacts, on the premise that triage speed, not raw discovery, is the real bottleneck in AI-assisted vulnerability work. Every model-driven role can be pointed at a different provider, including Anthropic's Claude, OpenAI-compatible endpoints, or open-weight models, with no single provider required.

It is written in Python.