Capital One open-sources VulnHunter, an agentic bug finder that checks its own work

Capital One has open-sourced VulnHunter, an agentic tool that hunts for exploitable bugs in source code rather than scanning for known patterns. It is out under the Apache 2.0 license on GitHub, and the bank says it has already run it across thousands of internal repositories spanning tens of business areas.

The interesting design choice is how VulnHunter deals with false positives, the usual reason security scanners get ignored. After the agent flags a possible vulnerability, a "falsification engine" runs a second reasoning pass whose only job is to disprove the finding, searching for gaps and unsupported assumptions before anything reaches a human. It also works the way an attacker would, starting from entry points that outside input can reach and reasoning forward through the code, instead of the traditional approach of starting at a dangerous function and working backward. When it does report a bug, it includes a concrete fix and an explanation of how the flaw could be exploited.

There is a dependency worth noting. VulnHunter is built to run on Claude Opus 4.8 inside Claude Code, though Capital One says the framework can be adapted to other models and harnesses.

Why it matters

If you run application security at any scale, the falsification step is the part to study: it targets the false-positive flood that makes most automated scanners a source of noise, and because the tool is Apache-licensed you can try it on your own repositories without a vendor commitment.