Visa has released its Vulnerability Agentic Harness (VVAH) as an open-source tool under an Apache 2.0 license. The framework was developed following a collaboration with Anthropic’s Project Glasswing in April 2026, which utilized the Claude Mythos AI model to stress-test Visa’s global infrastructure, covering over 200 countries and 5 billion payment credentials.
The initial testing phase identified more than 10,000 high and critical vulnerabilities within a single month. In response, Visa created VVAH, a four-phase pipeline designed for the discovery, triage, remediation, and validation of security flaws. The system operates on a zero-trust architecture and incorporates deterministic controls alongside human oversight.
Since its release around June 10, 2026, the tool has seen significant adoption, with tens of thousands of downloads and over 2,300 stars on GitHub by late August. An update on August 27, 2026, introduced automated remediation and validation features, allowing the system to propose, implement, and verify security fixes, thereby reducing response times.
While the VVAH framework remains free to use, Visa has expanded its business model by offering paid cybersecurity advisory services. These consulting offerings are designed to assist enterprises in implementing the framework and integrating it into their existing security infrastructures.
