Visa ships a security AI that patches production code before human review

Visa has introduced an open-source security harness that automates the entire vulnerability remediation process, from discovery to patching, without any human intervention. The system, which runs 11 distinct stages by default, first identifies security flaws in production code, then generates fixes, and finally pits those fixes against an adversarial panel—a suite of tests designed to break the patch. Only after passing this gauntlet does the loop edit the source files in the target repository. This 'self-harming' approach, where the AI attacks its own output, is intended to ensure that the patch is not only effective but also does not introduce new vulnerabilities. The most striking aspect is that this loop ships by default, meaning that in many environments, code can be patched and deployed before a human ever reviews it. While this dramatically speeds up response times to zero-day threats, it raises questions about accountability and oversight. Visa argues that the rigorous automated testing provides a higher baseline of safety than traditional human review, which is often delayed and error-prone. Security experts are divided: some see this as the inevitable future of DevSecOps, while others worry about the potential for unintended consequences when AI systems autonomously modify critical infrastructure. Regardless, Visa's move signals a clear trend toward fully autonomous security operations, where human roles shift from hands-on coding to high-level policy and exception handling.