VulnHunter is an open-source, agentic AI code security tool built internally at Capital One and released to the community on July 16, 2026. Unlike traditional “sink-first” SAST scanners that flag suspicious patterns and flood teams with false positives, VulnHunter reasons forward from attacker-accessible entry points — APIs, network messages, file uploads — through application logic to determine whether an exploit path is actually real.
Every finding passes through a falsification engine that tries to disprove its own conclusions before a developer ever sees them, and defects that survive get evidence-backed, targeted remediation proposals rather than just an alert. It ships as three composable Claude Code skills (/vulnhunt, /vulnhunter-fix, /vulnhunt-fix-verify) forming a hunt-fix-verify loop, plus a headless runtime and a batch-scanning harness for running it unattended across many repositories.
The project is released under the Apache 2.0 license on GitHub and requires access to Claude Opus running in Claude Code.