Visa Deploys AI That Patches Code Before Human Review

Visa turned on autopilot for its own codebase. The company's open-source security tool, the Visa Vulnerability Agentic Harness, now runs 11 stages start to finish: find a flaw, write the patch, subject that patch to an adversarial review panel made up of other AI agents, then commit it to the target repository. No human touches the code unless someone manually caps the pipeline at the detection stage. Visa announced the release Thursday alongside an expansion of its Visa Consulting & Analytics advisory arm.

The timing invites scrutiny. Eighteen days before Visa's announcement, researchers at Tenet Security walked the DEF CON 34 main stage through GhostJacking, an attack chain that had an AI agent lift a malicious payload straight out of a log file and use a valid credential to rewrite DNS records. Two days before that demo, Steve Wilson, Chief AI and Product Officer at Exabeam and co-lead of the OWASP Top 10 for LLM Applications project, argued in VentureBeat for building authorization gates outside the model, not inside it. Visa's default runs the other way.