VulnHunter: Capital One's Agentic AI Code Security Tool

As AI models drastically lower the cost for malicious actors to discover software vulnerabilities, defensive technology also needs to innovate. In response, Capital One developed and released VulnHunter.

Unlike existing vulnerability scanners, VulnHunter is an attacker's-perspective analysis tool equipped with an agentic reasoning workflow. It identifies potentially exploitable flaws in source code, traces attack paths, and then proposes concrete code fixes.

Three core technologies:

1. Falsification engine — It searches for counterarguments against its own findings. It identifies unfounded assumptions, logical gaps, and conditions that would cause an attack to fail, eliminating false alarms in advance.

2. Attacker-centric forward analysis — Existing tools work by tracing backward from risky code patterns, which produces many false positives. VulnHunter instead starts from attack entry points such as APIs, networks, and file uploads, then evaluates real exploitability by tracing through app logic, data transformations, and security checkpoints.

3. Evidence-based remediation modeling — Beyond just finding vulnerabilities, it gathers evidence to map the entire attack path and generates targeted code changes for developers to review.

Its developer-friendly design addresses the excessive false-alarm problem of existing security tools. Only verified, actionable results are delivered, reducing the triage burden on developers.

Capital One has already validated it across thousands of internal repositories, stating that it identifies and fixes vulnerabilities much faster and more efficiently than past manual reviews.

It is available on GitHub under the Apache 2.0 license, and requires Claude Opus 4.8 and Claude Code. It includes a quick-start guide, architecture documentation, and example workflows, and contributions are welcome.