What launched
Capital One open-sourced VulnHunter on July 16, 2026 — an agentic AI security tool built internally to find exploitable code vulnerabilities before attackers do, then propose fixes for them. It’s available now on GitHub under the Apache 2.0 license.
Why it matters
Most SAST tools use “sink-first” analysis: they flag suspicious-looking code patterns in isolation and let developers sort out which ones are actually exploitable, which tends to bury real issues under false positives. VulnHunter inverts that. It starts at attacker-reachable entry points — APIs, network messages, file uploads — and reasons forward through the application’s logic and security checkpoints the way an actual attacker would, then runs every candidate finding through a “falsification engine” designed to disprove its own conclusion before a developer ever sees it. Capital One says it used VulnHunter internally across thousands of its own repositories before releasing it.
Who it’s for
- Security and platform engineering teams looking for a SAST alternative that produces fewer, higher-confidence findings instead of a long triage backlog.
- Developers who want a security tool that hands back a proposed fix and a test, not just an alert.
- Teams already standardized on Claude Code, since VulnHunter ships as three composable Claude Code skills (
/vulnhunt,/vulnhunter-fix,/vulnhunt-fix-verify) plus a headless runtime for running scans unattended at scale.
How it works
The hunt-fix-verify loop is split into three stages: /vulnhunt maps entry points to dangerous sinks and filters findings through a multi-stage falsification pipeline; /vulnhunter-fix writes a failing security test, implements the fix, and confirms the exploit is blocked without regressions; /vulnhunt-fix-verify is a separate, read-only agent that independently checks whether a fix actually worked, so remediation is verified rather than just claimed.
Where to try it
VulnHunter is available now at github.com/capitalone/vulnhunter. It requires access to Claude Opus running in Claude Code — the repository includes a Quickstart guide and example workflows.