Capital One has released VulnHunter, an open-source agentic AI security tool designed to identify exploitable software vulnerabilities and recommend targeted code fixes. Developed internally by Capital One, VulnHunter analyzes source code from an attacker’s perspective rather than operating as a conventional passive vulnerability scanner.
The tool uses an agentic reasoning workflow to identify potentially exploitable defects, trace possible attack paths and propose focused remediations for developers to review.
Capital One developed VulnHunter in response to the growing use of advanced AI models in offensive cybersecurity.
AI can reduce the time and technical expertise required to identify software weaknesses, potentially allowing attackers to discover and exploit vulnerabilities at a greater scale.
Traditional defenses such as network segmentation, identity controls and security monitoring remain important, but Capital One believes organizations must also detect and repair vulnerabilities within their code before attackers can exploit them.
VulnHunter is intended to bring proactive security analysis directly into software development workflows.
The platform was built with a developer-focused approach intended to reduce false alerts and minimize the manual effort required to evaluate security findings.
Traditional code security tools can generate large numbers of warnings based on potentially dangerous coding patterns, even when those patterns do not create an exploitable path.
Engineering teams must then investigate these alerts to determine whether they represent genuine security risks.
VulnHunter uses a falsification engine designed to challenge and potentially disprove its own findings before presenting them to a developer.
After identifying a possible vulnerability, the tool searches for unsupported assumptions, logical gaps and environmental conditions that would prevent an attack from succeeding.
Findings that depend on unsupported assumptions are discarded.
As a result, vulnerabilities presented to developers have already gone through an internal reasoning process intended to determine whether an attacker could realistically exploit them.
The company said this approach can reduce the burden of manually triaging speculative alerts and allow developers to concentrate on evidence-backed repairs.
VulnHunter also uses what Capital One describes as attacker-first forward analysis.
Many conventional security tools begin with a potentially dangerous section of code and work backward to determine whether an attacker might be able to reach it.
This sink-first approach can flag risky patterns without establishing a complete and practical attack path.
VulnHunter instead starts with locations an attacker could potentially access, including application programming interfaces, network messages and file-upload functions.
The tool then follows the path forward through application logic, data transformations and internal security controls.
This process is intended to model how an attacker would interact with an application and determine whether the person could move from an accessible entry point to a meaningful security breach.
When a vulnerability survives the falsification process, VulnHunter gathers evidence from across the codebase and maps the complete exploit path.
The tool is designed to explain the underlying defect, identify the access or capabilities an attacker could gain and generate targeted code changes for engineering review.
VulnHunter therefore moves beyond identifying possible problems by helping developers understand and remediate confirmed findings.
Before releasing the technology publicly, Capital One tested VulnHunter against its own software environment.
The company said the tool helped identify and remediate vulnerabilities across thousands of code repositories spanning dozens of business areas.
Capital One reported that VulnHunter produced verified and actionable findings more quickly than processes requiring extensive manual analysis and triage.
The company is releasing the platform as open-source software because modern software supply chains are interconnected across companies and industries.
A vulnerability in a widely used open-source component can affect thousands of businesses and applications simultaneously.
Making VulnHunter publicly available allows developers and cybersecurity researchers to inspect its reasoning workflow, test its assumptions and contribute improvements.
The source code is available under the Apache License 2.0, which allows organizations and developers to use, modify and distribute the software subject to the license’s conditions.
The initial implementation was created as a Claude Code skill and optimized for the Claude Opus 4.8 model.
Running the current version requires access to Claude Opus 4.8 and a functioning Claude Code environment.
The repository includes a Quickstart guide, technical architecture documentation and annotated examples illustrating how VulnHunter traces code paths and generates recommended fixes.
Capital One has also documented the tool’s known limitations and active development roadmap.
The company is inviting the open-source community to report bugs, propose modifications to the reasoning process and expand support for additional foundation models and coding environments.
Although VulnHunter was initially developed around Claude Opus 4.8 and Claude Code, Capital One said the underlying framework and skills could potentially be adapted for other models and coding platforms.
The release gives security teams and software developers a new open-source option for using agentic AI to find and repair code vulnerabilities before attackers can exploit them.
