Visa Vulnerability Agentic Harness — Agentic SAST Pipeline

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/visa/visa-vulnerability-agentic-harness
• Blog Title: Visa Vulnerability Agentic Harness — Agentic SAST Pipeline
• Suggested Section: AI Security > AI Assisted Fuzzing And Vulnerability Discovery, or Pentesting Web > Source code Review / SAST Tools

🎯 Content Summary

Visa Vulnerability Agentic Harness (VVAH) is Visa's open-source agentic SAST pipeline for autonomous vulnerability discovery using frontier AI models. It is built from learnings from Anthropic's Project Glasswing, which focuses on AI-assisted vulnerability research.

This repository describes a security testing tool, not a specific CVE, exploit, or copy/paste vulnerability PoC. Its purpos...

🔧 Technical Details

Agentic SAST workflow pattern: instead of asking one model to scan code directly, structure vulnerability discovery as a staged pipeline. First map the attack surface using code and contextual data such as CMDB records, CVE feeds, and control feeds. Then perform threat modeling using STRIDE, OWASP categories, and trust-boundary analysis. This makes later vulnerability research focus on reachable components, authorization boundaries, APIs, taint paths, and business-relevant impact instead of isolated code smells.

Multi-agent validation to reduce false positives: when using LLMs for vulnerability research, do not trust a finding only because a single model produced it. Route the finding through specialized agents or roles such as language-specific reviewers, crypto reviewers, logic-bug reviewers, access-control reviewers, batch/ETL reviewers, and IaC reviewers. Combine this with deterministic voting or policy gates so a finding must survive mult...

🤖 Agent Actions

Done: updated src/network-services-pentesting/pentesting-web/code-review-tools.md.

Added:

• a concise Agentic SAST pipelines section
• transferable methodology from VVAH:
  • threat-model-first scanning
  • specialist multi-pass review
  • deterministic gates / voting
  • adversarial exploitability verification
  • dedup + CWE/CVSS + SARIF reporting
• a small vvaharness quick-start example
• references to VVAH, its architecture doc, and Project Glasswing

I chose the existing Source code Review / SAST Tools page because this is a SAST/code-review workflow, not primarily fuzzing.

Validation:

• checked the inserted markdown and references placement
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/visa/visa-vulnerability-agentic-harness

Content Categories: Based on the analysis, this content was categorized under "AI Security > AI Assisted Fuzzing And Vulnerability Discovery, or Pentesting Web > Source code Review / SAST Tools".

Repository Maintenance:

• MD Files Formatting: 977 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0