Capital One on Thursday (July 17, 2026) released VulnHunter, an open-source agentic AI security tool that scans source code for exploitable vulnerabilities, maps attacker reachability, and proposes targeted fixes before code ships. Available on GitHub under Apache 2.0.
How it differs from traditional SAST:
- “Attacker-first forward analysis”: starts at real entry points (APIs, network messages, file uploads) and reasons forward through application logic to see if an exploit path survives existing defenses.
- Conventional scanners typically flag dangerous patterns and search backward — producing many false positives.
- Built-in “falsification engine” tries to disprove findings (logical gaps, unsupported assumptions, blocking conditions) before developers see them; survivors include full exploit-path explanation and proposed code fix.
Runtime: Currently runs on Anthropic Claude Opus 4.8 inside a Claude Code environment; Capital One says the framework could work across other foundation models and coding harnesses.
Rationale (CISO Chris Nims): Open-sourced because modern software supply chains are highly connected and AI attack capabilities are becoming affordable to many adversaries; defensive tools should be “just as widely distributed, tested, and improved as the codebases they protect.”
Validation: Capital One says it ran VulnHunter across thousands of internal repositories spanning tens of business areas before release.
Context: Article also recounts Capital One’s 2019 cloud breach (~100M US / 6M Canada affected; OCC $80M fine in 2020) and subsequent open-source / OpenSSF investment as reputation rebuild — VulnHunter framed as the most consequential open-source security product from that effort.