Visa launches AI that automatically patches production code vulnerabilities

Visa has launched an automated security system that can detect vulnerabilities, generate a fix, and apply the patch to a production code repository before any human engineer reviews it. The new tool, part of Visa’s open‑source Security Harness, is shipped with the default setting enabled, meaning the process runs automatically unless the operator chooses to stop it at the detection stage.

The move follows a recent demonstration by Tenet Security at DEF CON 34 that highlighted a new attack called GhostJacking. In the demo, an attacker’s payload was read from a log file and used to rewrite DNS settings with valid credentials, showing how quickly a system can be compromised. Visa’s announcement also dovetails with the company’s expansion of its Visa Consulting & Analytics advisory practice, positioning the harness as a core component of its security services.

The harness runs through 11 stages of analysis, automatically editing source files in the target repository. If an operator opts out, the tool can be capped at the detection phase. The AI writes the patch code itself and then subject it to an adversarial panel that tests the patch against potential attack vectors. The entire loop—detection, patch creation, adversarial testing, and deployment—is enabled by default, allowing for rapid response to newly discovered threats.

Critics, including Steve Wilson of Exabeam, argue that such a default is risky. Wilson, who co‑led the OWASP Top 10 for LLM Applications, said the first step should be an authorization gate outside the model. His concern points to broader questions about the safety of fully automated patching. If Visa’s approach proves reliable, it could reshape how financial services and other high‑risk sectors handle code security, but it may also invite regulatory scrutiny as the industry balances speed with oversight.