It looks fixed
Visa open-sourced an AI pipeline that reads your code, finds the flaw, writes the patch, and grades its own repair a pass — without compiling, building, or running a line of it. Their own write-up openly said it is not enough.
30 June 2026
Every engineer knows the one-line fix that is obviously right and breaks the moment it runs. The distance between a change that looks correct and one that is correct is where much of software’s misery lives, and closing it is the whole reason we compile, run the tests, and push to staging before production. A patch that has only ever been read is a guess.
Visa’s tool for closing that distance is a serious piece of engineering. Its Vulnerability Agentic Harness reads a codebase, reasons about where an attacker would push, writes up the flaw it finds, proposes a fix, and then does the thing worth slowing down for: it grades its own repair. The result comes back as a weighted score, carried to four decimal places, that maps onto a neat verdict of Fixed or Partially Fixed. The one thing the pipeline never does, at any stage, is run the code. It says so itself:
[The pipeline] does not compile, build, or run tests against the patched tree.
The fix is an opinion. A careful, well-reasoned opinion, formed by a strong reader looking hard at a diff, but an opinion all the same. The stage that produces the verdict is called validation. It runs a small panel of reviewer personas with names like penetration-tester, and not one of them can execute anything: they are read-only. A penetration tester who cannot run the exploit is writing a book review. The number they hand back measures their confidence, not the behaviour of a program, and four decimal places is just decoration.
None of which Visa hides. Its documentation states, without flinching, that findings and fixes are “triage candidates, not confirmed vulnerabilities or production-ready patches,” and that human review is required; the engineering write-up is more scrupulous than any headline about it. The criticism is not that Visa oversells. It is that the vocabulary quietly promises what cannot be delivered: validated is a word about the world, and nothing here touched the world. The sharpest evidence is Visa’s own words:
The real challenge is how quickly a team can confirm that an issue is truly exploitable, fix it, and then prove the attack path is closed.
That is exactly the problem their tool was built to solve, and both halves of it — truly exploitable, and the attack path is closed — are claims about what the code does when it runs. We hit the same wall; by day forty-nine Cybernuke had produced five-hundred plus reports, each one a hunch no one had time to confirm. What we did next was solve that problem: run the code, and settle every claim on the wire. Visa built the tool and stopped one step short.
This is not a Visa blunder, but a property of the whole approach; every automated bug-finder needs an oracle: the thing that has to be true before a hunch becomes a finding. For a tool that reads source and reasons about it, the oracle is an agent’s judgement, and that judgement is genuinely good at seeing the shape of a bug. What it cannot do, by construction, is two things:
Is the defect real? Visa cannot tell a real defect from code it dislikes. An external requirement settles it: measured against one, a defect is a fact.
Was there a cost? Visa cannot say, because the consequence only shows when the code runs. Execution settles it: on the wire, a cost is a fact.
That is the oracle we build: a compliant reference stands beside the flawed program and rejects exactly what the flawed one waved through. We then run the attack and measure the attacker’s gain. The difference is concrete. An agent reading a library’s encryption path might notice a security check whose result is computed and thrown away. Reading cannot tell whether discarding is forbidden, or what the silence is worth; running shows both.
Their tool is not useless. A fast reader that tells you where to look is worth having, and Visa is clear that this is all it is. A patch that looks fixed and a patch that is fixed are two different claims, and the entire discipline of security is the refusal to confuse them. Reading can hand you the first. Only running the code reaches the second.