Visa's Vulnerability Agentic Harness is recorded as a governed-evaluation signal. The useful shape is a harness that separates the agent under test, the vulnerability task, the target environment, scoring, and the governance boundary.
That structure matters because security agents are easy to overstate. A harness can make the difference between permissioned evaluation and unsafe operational folklore. The next signal to watch is whether VVAH-style artifacts become reproducible enough for external teams to compare agents without exposing real targets or exploit paths.