Capital One Releases VulnHunter, an Open-Source AI Tool for Finding Exploitable Code Vulnerabilities
Capital One Releases VulnHunter, an Open-Source AI Tool for Finding Exploitable Code Vulnerabilities #
Capital One has released VulnHunter as open source on GitHub under an Apache 2.0 licence. The agentic AI security tool scans source code from an attacker’s perspective to identify exploitable weaknesses.
Unlike traditional static application security testing (SAST) scanners, which flag suspicious code patterns and can generate large numbers of false positives, VulnHunter starts its analysis from attacker-accessible entry points such as APIs, network messages, or file upload endpoints. It then traces application logic to determine whether a flaw is genuinely exploitable, according to the company.
A central feature is what Capital One calls a “falsification engine.” After the tool surfaces a potential vulnerability, a structured reasoning workflow tries to disprove the finding by looking for logical gaps, unsupported assumptions, or conditions that would stop an attack from succeeding. Only flaws that survive that internal challenge are passed to developers, with the aim of reducing alert fatigue.
When a vulnerability clears that bar, VulnHunter maps the full exploit path across the codebase and generates targeted code changes for engineering review, rather than leaving developers to work out a fix on their own.
Chris Nims, Capital One’s executive vice president and chief information security officer, said the release was motivated by a narrowing gap between offensive and defensive AI capabilities. “We designed VulnHunter with a developer-first mindset to solve a massive industry pain point: overwhelming false positives that create friction and slow down daily workflows,” Nims said in a LinkedIn post cited by SecurityWeek. He added that the window before sophisticated AI attack tools become widely affordable and accessible to adversaries is shortening fast.
Capital One said that in internal use, VulnHunter identified and remediated vulnerabilities across thousands of code repositories spanning tens of business areas. The company noted on GitHub that no single organisation can tackle modern software supply-chain security challenges alone, citing that as a reason for releasing the tool publicly rather than keeping it proprietary.
Capital One has previously released other security and infrastructure tools as open source.
Copy link