Capital One Open-Sources VulnHunter, an Agentic AI Security Scanner

Capital One dropped VulnHunter into the open-source world today — an agentic AI security tool that doesn't just scan for known bad patterns but reasons through code like an attacker would. It's built on top of Claude Opus 4.8 and designed to be a proactive defense against the coming wave of AI-powered exploits.

What Makes VulnHunter Different

Most vulnerability scanners are passive: they match signatures, flag suspicious patterns, and drown developers in false positives. VulnHunter flips the model. It starts at attacker-accessible entry points — APIs, message queues, file upload handlers — and traces forward through the application logic, data transformations, and security checks. It simulates the exact journey a real adversary would take.

The tool includes a falsification engine that actively tries to disprove its own findings. After surfacing a potential vulnerability, it searches for assumptions that don't hold, logical gaps in the exploit path, and conditions that would block the attack. Only findings that survive this internal challenge reach a developer's screen. That's a deliberate design choice to minimize the noise that plagues traditional scanners.

Evidence-Backed Remediation

When a defect passes the falsification check, VulnHunter doesn't just raise an alarm. It gathers supporting evidence across the codebase, maps the entire exploit path, and generates targeted code changes. The developer gets a clear explanation of the defect, the specific capabilities an attacker would gain, and a proposed fix — all ready for review.

Developer Experience First

Capital One claims they built VulnHunter with a developer-first mindset, aiming to reduce friction rather than add another security gate that slows down shipping. The tool is implemented as a Claude Code skill, which means it integrates into the existing Claude Code workflow. Developers can run it against their repositories and get results without context-switching to a separate security dashboard.

Validation and Availability

Before the open-source release, Capital One ran VulnHunter across thousands of their own repositories spanning tens of business areas. They report that findings that previously required significant manual triage now produce verified, actionable results quickly.

VulnHunter is available now on GitHub under the Apache License 2.0. You'll need access to Claude Opus 4.8 and a working Claude Code environment to run it. The repository includes a Quickstart guide, architecture docs, and annotated example workflows. The team also documented known limitations and the active development roadmap.

While the initial implementation is optimized for Claude models, the framework is designed to be adaptable to other coding harnesses and foundation models. Contributions are welcome — whether bug reports, reasoning workflow changes, or expanding model support.