Raw capture — raw/vulnhunter.md
url: https://www.capitalone.com/tech/open-source/announcing-vulnhunter/ title: "Announcing VulnHunter: Capital One's open-source, agentic AI code security tool" author: Capital One Tech date_fetched: 2026-07-18 date_published: 2026-07-16
Capital One Tech · July 16, 2026 · 5 min read
The article opens by describing an accelerating threat landscape where AI models have made vulnerability discovery cheaper and faster for attackers. Traditional defenses like network segmentation and identity controls, while still important, are framed as no longer sufficient on their own. The piece argues that the industry faces a narrowing window before "highly sophisticated, next-generation AI attack capabilities" become widely accessible.
Capital One's response was to "build cutting-edge AI-driven defenses" and open-source them rather than wait.
VulnHunter is described as an "advanced agentic AI security tool" that performs attacker-perspective analysis on source code. It is explicitly not a traditional passive vulnerability scanner. Instead, it uses an agentic reasoning workflow to identify exploitable defects, map potential attack paths, and propose targeted code remediations.
Repository: github.com/capitalone/vulnhunter License: Apache License 2.0 Model Optimization: Claude Opus 4.8 Initial Implementation: Claude Code skill
The article notes that traditional security tools are "often built primarily to enforce rigid cybersecurity practices" without considering developers' actual workflows. Capital One took a developer-first approach, aiming to reduce false-positive triage burden so developers can focus on "immediate, evidence-backed code repair."
After surfacing a finding, VulnHunter runs "a structured reasoning workflow specifically designed to disprove its own argument." It actively searches for unsupported assumptions, logical gaps in the exploit path, and conditions that would prevent an attack. Findings that rely on shaky assumptions are discarded. Any vulnerability that reaches a developer has already survived an internal attempt to rule it out.
Rather than the conventional "sink-first" approach that looks for dangerous code patterns in isolation, VulnHunter simulates an attacker's full journey. It starts at attacker-accessible entry points — APIs, network messages, file uploads — and reasons forward through application logic, data transformations, and security checkpoints to determine whether an attacker could actually succeed.
When a finding survives the falsification step, VulnHunter gathers evidence across the codebase to map the full exploit path. It explains the defect, describes what an attacker would gain, and generates "focused, targeted code changes for engineering review."
Before public release, Capital One ran VulnHunter on its own codebase. The tool identified and remediated vulnerabilities "across thousands of repositories, spanning tens of business areas," producing verified, actionable findings faster than previous manual triage processes.
The article argues that modern software supply chains are deeply interconnected — a single vulnerability in a popular open-source component can affect thousands of enterprises simultaneously. Capital One's rationale for open-sourcing is that "no single organization can solve this challenge alone." The hope is that the broader community will inspect the workflow, challenge its assumptions, and contribute improvements.
Users need access to Claude Opus 4.8 and a working Claude Code environment. The repository includes a Quickstart guide, architecture docs, and annotated example workflows. The article also notes that while VulnHunter was authored with those specific models in mind, "the framework and skills have potential to be leveraged across coding harnesses and foundation models."
Contributions — bug reports, reasoning workflow changes, or expanded model support — are handled via CONTRIBUTING.md.
"The threat landscape isn't waiting. We built VulnHunter to give defenders a more rigorous, evidence-driven way to find and fix vulnerabilities before attackers can reach them."
© 2026 Capital One. Opinions are the author's own.