Capital One Releases VulnHunter, an Open‑Source AI Security Tool

Capital One has released VulnHunter, an open‑source agentic AI security tool designed to help organizations find and fix vulnerabilities before attackers armed with advanced AI models can exploit them.

The company says the accelerating pace of AI‑enabled attacks requires defenders to shift from traditional perimeter controls to proactive code‑level detection and remediation. VulnHunter applies attacker‑style reasoning directly to source code, identifying exploitable defects, mapping realistic attack paths, and generating targeted fixes backed by evidence from across the codebase.

Capital One built the tool with a developer‑first approach, aiming to reduce friction and avoid the false positives that slow engineering teams. VulnHunter includes a falsification engine that attempts to disprove its own findings before surfacing them, and a forward analysis model that traces how an attacker would move through APIs, data flows, and internal logic. When a flaw survives those checks, the tool explains the defect, outlines the access an attacker would gain, and proposes precise code changes for review.

The company validated VulnHunter across thousands of its own repositories, saying tasks that once required extensive manual triage now produce actionable results quickly. Capital One is open‑sourcing the tool to support collective defense across the software ecosystem, arguing that modern supply chains are too interconnected for any single organization to secure alone. The GitHub repository includes documentation, examples, and contribution guidelines, and requires access to Claude Opus 4.8 and a working Claude Code environment.

Capital One says the threat landscape is evolving too quickly to wait, and that VulnHunter is meant to give defenders a rigorous, evidence‑driven way to uncover vulnerabilities before attackers do.