--- title: VulnHunter: an open-source, agentic AI code security tool description: Capital One has open-sourced VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective to find and remediate... canonical: https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: VulnHunter: an open-source, agentic AI code security tool | daily.dev og:description: Capital One has open-sourced VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective to find and remediate... og:url: https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx og:image: https://api.daily.dev/og/posts/sUx4ssvhX.png og:image:alt: VulnHunter: an open-source, agentic AI code security tool og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # VulnHunter: an open-source, agentic AI code security tool **[Hacker News](https://daily.dev/sources/hn)** · 6 min read · 2 upvotes · 0 comments ## Summary Capital One has open-sourced VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective to find and remediate vulnerabilities. Unlike traditional scanners, it uses a forward-analysis approach starting from attacker-accessible entry points (APIs, file uploads, network messages) and traces paths through application logic. A built-in falsification engine challenges its own findings to minimize false positives before surfacing results to developers. When a vulnerability survives this challenge, the tool generates targeted code remediations with supporting evidence. Built on Claude Opus 4.8 and Claude Code, it was validated internally across thousands of Capital One repositories. The tool is available on GitHub under Apache 2.0 license. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is VulnHunter and how does it differ from traditional vulnerability scanners? VulnHunter is an open-source, agentic AI code security tool from Capital One that performs attacker-perspective analysis instead of passive pattern scanning. Rather than sink-first backward analysis, it starts from attacker-accessible entry points like APIs, network messages, or file uploads and reasons forward through application logic. A falsification engine then tries to disprove each finding before it reaches a developer, and surviving defects get evidence-backed remediation suggestions. _Track new agentic security tools like VulnHunter as they emerge by following AI-assisted security coverage on daily.dev._ ### What model and environment does VulnHunter require to run? VulnHunter requires access to Claude Opus 4.8 and a working Claude Code environment, since it was built and optimized as a Claude Code skill. The repository includes a quickstart guide, architecture documentation, and example workflows. The framework is designed with potential to extend to other coding harnesses and foundation models in the future, though that support is not yet built out. _Developers evaluating Claude-based security tooling can compare setup requirements on daily.dev before adopting VulnHunter._ ### What license is VulnHunter released under and where can I find it? VulnHunter is released under the Apache License 2.0 and is available on GitHub at capitalone/vulnhunter. The repository includes a CONTRIBUTING.md for submitting bug reports, reasoning workflow changes, or expanded model support, along with documented known limitations and an active development roadmap. _Developers picking open-source security tools can weigh licensing and contribution models discussed on daily.dev._ ## Similar posts on daily.dev - [CISOs in a Pinch: A Security Analysis of OpenClaw](https://daily.dev/posts/cisos-in-a-pinch-a-security-analysis-of-openclaw-wq3pmvkrr) · Trend Micro · 0 upvotes · 0 comments - [Build your own vulnerability harness](https://daily.dev/posts/build-your-own-vulnerability-harness-qm0qjudbn) · Cloudflare · 3 upvotes · 0 comments - [Sonar AI Agent Discovers Vulnerabilities Hidden in Business Logic Workflows](https://daily.dev/posts/sonar-ai-agent-discovers-vulnerabilities-hidden-in-business-logic-workflows-ztdksjwsq) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#claude](https://daily.dev/tags/claude), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"VulnHunter: an open-source, agentic AI code security tool","url":"https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx"},"datePublished":"2026-07-17T14:50:16.583Z","dateModified":"2026-09-14T09:04:51.676Z","description":"Capital One has open-sourced VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective to find and remediate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f66e861672a6430909e13945b8321d0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f66e861672a6430909e13945b8321d0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,claude,agentic-ai","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"VulnHunter: an open-source, agentic AI code security tool"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vulnhunter-an-open-source-agentic-ai-code-security-tool-sux4ssvhx#faq","mainEntity":[{"@type":"Question","name":"What is VulnHunter and how does it differ from traditional vulnerability scanners?","acceptedAnswer":{"@type":"Answer","text":"VulnHunter is an open-source, agentic AI code security tool from Capital One that performs attacker-perspective analysis instead of passive pattern scanning. Rather than sink-first backward analysis, it starts from attacker-accessible entry points like APIs, network messages, or file uploads and reasons forward through application logic. A falsification engine then tries to disprove each finding before it reaches a developer, and surviving defects get evidence-backed remediation suggestions. Track new agentic security tools like VulnHunter as they emerge by following AI-assisted security coverage on daily.dev."}},{"@type":"Question","name":"What model and environment does VulnHunter require to run?","acceptedAnswer":{"@type":"Answer","text":"VulnHunter requires access to Claude Opus 4.8 and a working Claude Code environment, since it was built and optimized as a Claude Code skill. The repository includes a quickstart guide, architecture documentation, and example workflows. The framework is designed with potential to extend to other coding harnesses and foundation models in the future, though that support is not yet built out. Developers evaluating Claude-based security tooling can compare setup requirements on daily.dev before adopting VulnHunter."}},{"@type":"Question","name":"What license is VulnHunter released under and where can I find it?","acceptedAnswer":{"@type":"Answer","text":"VulnHunter is released under the Apache License 2.0 and is available on GitHub at capitalone/vulnhunter. The repository includes a CONTRIBUTING.md for submitting bug reports, reasoning workflow changes, or expanded model support, along with documented known limitations and an active development roadmap. Developers picking open-source security tools can weigh licensing and contribution models discussed on daily.dev."}}]} ```