Capital One has released VulnHunter, an open-source AI-powered application security tool designed to identify exploitable software vulnerabilities before code reaches production. Published under the Apache 2.0 licence, the framework combines agentic reasoning with code analysis to trace how an attacker could move through an application, determine whether a vulnerability is genuinely exploitable, and generate remediation guidance for developers.
Unlike many traditional static analysis tools that begin with suspicious code patterns and work backwards to determine whether they are reachable, VulnHunter adopts what Capital One describes as an attacker-first approach. The framework starts from external entry points such as API endpoints, network message handlers and file upload interfaces before following the application's execution path to assess whether malicious input can successfully bypass existing security controls and reach vulnerable code.
A distinguishing component of the framework is its built-in falsification engine. Rather than presenting every suspected issue to developers, VulnHunter attempts to invalidate its own findings by testing assumptions, examining application logic and identifying conditions that would prevent an exploit from succeeding. Findings that fail these internal verification steps are discarded, while validated issues are accompanied by a detailed explanation of the attack path, supporting evidence gathered from the codebase and a proposed code change that developers can review before deployment.
Capital One said the current implementation operates within Anthropic's Claude Code environment using Claude Opus 4.8, although the framework has been designed with the flexibility to support additional foundation models and coding environments in the future.
The financial institution said it decided to release the project publicly because software supply chains have become increasingly interconnected, making application security a shared challenge rather than one that can be solved by individual organisations. Chris Nims, Capital One's Chief Information Security Officer, said the growing accessibility of AI-driven offensive capabilities has reduced the time defenders have to identify and remediate vulnerabilities before they can be exploited by attackers. By making VulnHunter openly available, the company hopes security researchers and developers will continue improving the framework while strengthening software security across the wider ecosystem.
The release builds on Capital One's wider investment in open-source software and secure software development. The company began publishing open-source projects more than a decade ago, later adopting an open-source-first strategy and expanding its participation in community-driven security initiatives. It has since contributed to dozens of public projects and joined the Open Source Security Foundation (OpenSSF) as a premier member to support collaborative efforts around software supply chain security and governance.
Capital One also said it evaluated VulnHunter internally across thousands of software repositories spanning multiple business units before its public release. According to the company, the framework helped identify and remediate vulnerabilities more efficiently than previous manual review processes by reducing unnecessary alerts and providing developers with evidence-backed remediation guidance.
The announcement comes as organisations increasingly explore AI-assisted approaches to application security in response to the growing use of AI by threat actors to discover software weaknesses, automate exploit development and accelerate attacks. Security teams have also faced persistent challenges with alert fatigue caused by conventional vulnerability scanners that frequently generate false positives requiring extensive manual verification.
Capital One believes embedding security analysis directly into the software development lifecycle can help organisations identify exploitable weaknesses earlier, allowing developers to address issues before applications are deployed. As AI continues to reshape both offensive and defensive cybersecurity capabilities, tools that combine contextual code analysis, automated reasoning and actionable remediation may become an increasingly important part of modern secure software development practices.
