Visa reportedly ships AI that patches production code before human review

Visa’s move embeds AI-driven security into the deployment pipeline as a default step, not an optional scan. The harness reportedly performs 11 stages, from vulnerability detection to patch validation, without pausing for human approval. This automation could shrink the window between discovery and remediation but also risks deploying untested fixes at scale. Engineers integrating this tool must weigh its speed against the potential for false positives or unintended side effects in complex codebases.

The adversarial panel mentioned in the headline suggests the AI evaluates its own patches before deployment, adding a layer of self-validation. However, the lack of human oversight until after changes are applied raises questions about accountability. If the AI misdiagnoses a vulnerability or generates a flawed patch, the error propagates automatically. Teams adopting this tool will need robust rollback mechanisms and post-deployment monitoring to mitigate risks.

Shipping this as open-source implies Visa is targeting external adoption, not just internal use. The default-on behavior means engineers must explicitly opt out if they want human review first. This could accelerate security fixes across the industry but also standardizes a high-trust model for AI-generated code changes. The trade-off between speed and safety will likely spark debate, especially in regulated or high-assurance environments where manual review is mandatory.