VulnHunter: Capital One's Agentic AI Code Security Tool Now Open Source

Capital One has open-sourced VulnHunter, an agentic AI code security tool that proactively analyzes source code from an attacker's perspective. Built to counter the growing threat of AI-driven exploit automation, VulnHunter does three things that distinguish it from passive scanners: it runs a falsification engine to minimize false positives, it reasons forward from attacker-accessible entry points rather than backward from dangerous sinks, and it produces evidence-backed code remediations.

Key Technical Features

• Falsification Engine: After identifying a potential vulnerability, VulnHunter actively attempts to disprove its own finding by searching for unsupported assumptions, logical gaps, or conditions that would prevent the attack. Only findings that survive this adversarial check reach the developer.
• Attacker-First Forward Analysis: Instead of sink-first pattern matching, VulnHunter starts at attacker-accessible entry points (APIs, network messages, file uploads) and reasons forward through application logic, data transformations, and security checkpoints to evaluate whether an attacker can actually break through.
• Evidence-Backed Remediation: When a finding survives falsification, VulnHunter maps the entire exploit path, describes the capabilities an attacker would gain, and generates focused code changes for developer review.

Developer Experience Focus

VulnHunter was designed to reduce triage burden by intentionally avoiding false alarms. The tool aims to deliver only findings that have been rigorously challenged internally, so developers can focus on repairing verified vulnerabilities rather than sifting through noise.

The tool is built for enterprise scale, but the open-source release makes it available to any development team. While Capital One ran it on their own codebase before releasing, the source includes the full agentic reasoning workflow and the falsification engine.