Capital One has open-sourced VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective to find and remediate vulnerabilities. Unlike traditional scanners, it uses a forward-analysis approach starting from attacker-accessible entry points (APIs, file uploads, network messages) and traces paths through application logic. A built-in falsification engine challenges its own findings to minimize false positives before surfacing results to developers. When a vulnerability survives this challenge, the tool generates targeted code remediations with supporting evidence. Built on Claude Opus 4.8 and Claude Code, it was validated internally across thousands of Capital One repositories. The tool is available on GitHub under Apache 2.0 license.
