Summary
- Visa says future attacks are likely to become increasingly adaptive and autonomous as agentic AI capabilities improve.
- Its open-source Vulnerability Agentic Harness now spans vulnerability discovery, remediation, and validation.
- The payments operator is treating defensive autonomy, human governance, and cryptographic transition as connected resilience problems.
Visa is preparing its cyber-defence architecture for attacks driven by increasingly autonomous artificial-intelligence systems, arguing that conventional human-led response will struggle to match adversaries able to probe, adapt, and operate continuously at machine speed.
Rajat Taneja, Visa’s president of technology, told Reuters that experiments with advanced AI systems had exposed weaknesses that changed the company’s view of the threat. He described those findings as “humbling” and said Visa expects future attacks to learn and adapt with less direct human intervention.
The warning carries particular weight because of Visa’s position in global payments infrastructure. The company processes roughly a billion payments a day worth around $15 trillion annually, according to figures cited by Reuters, meaning resilience failures can extend well beyond the confidentiality of an individual corporate network.
Visa’s response is not limited to adding AI to conventional monitoring. Earlier this year, the company open-sourced its Vulnerability Agentic Harness, or VVAH, following work with Anthropic’s Project Glasswing. The framework is designed to use AI models to discover, triage, remediate, and validate software vulnerabilities within a structured workflow.
The open-source release itself is not new: Visa first made the framework available in June and expanded it in August. The fresh development is the company’s account of why it views that work as part of a wider architectural change in defence rather than simply another vulnerability-scanning project.
Taneja told Reuters that an agentic adversary creates a fundamental speed mismatch for a defensive model that depends on people manually interpreting alerts and deciding each subsequent action. Visa is therefore working towards systems in which AI can perform more discovery, validation, remediation, and containment while retaining explicit human governance over consequential decisions.
That balance is likely to become one of the harder questions in autonomous security. A defensive system gains value from being able to act quickly, but the same authority creates operational risk if an agent misclassifies legitimate activity, applies an unsafe fix, or takes action in a system whose dependencies it does not understand.
Visa’s public material consequently emphasises human review at key points. Security and engineering personnel validate findings and severity, determine remediation paths, and retain oversight while automated components accelerate parts of the workflow. The company describes the objective as faster expert decision-making rather than removal of human accountability.
The payments group is also treating quantum computing as part of the same longer-term resilience agenda. Current cryptographic standards underpin authentication and confidentiality throughout financial systems, and migration to post-quantum alternatives will require changes across payment infrastructure long before a cryptographically relevant quantum computer is available.
AI-driven attacks and quantum risk operate on very different timelines, but both expose the cost of waiting for a threat to become operational before changing architecture. Visa’s approach is to use current testing to identify where human-dependent processes and long-lived cryptographic assumptions could become future constraints.
The immediate evidence does not establish that autonomous AI attacks are already overwhelming payment networks. It shows that one of the world’s largest payments operators is designing for that possibility now — and increasingly expects defensive systems themselves to become autonomous enough to keep pace without surrendering human control of the decisions that carry the greatest consequence.
