Capital One has released VulnHunter, an open-source AI security tool that scans source code for exploitable vulnerabilities, maps attack paths through application logic, and proposes fixes before code reaches production. The tool is now available on GitHub under an Apache 2.0 license.
Built internally at Capital One and now publicly released, VulnHunter represents an attempt to turn offensive AI capabilities into a defensive resource. The tool introduces what the company calls an “attacker-first forward analysis” approach, starting at the points where a real adversary would enter a system – such as APIs, network messages, or file uploads – and reasoning forward through the application’s logic to determine whether an exploit path actually survives existing defences.
Conventional vulnerability scanners typically work in reverse, flagging dangerous-looking code patterns and then searching backward for a hypothetical attacker. This approach generates a high volume of false positives, overwhelming engineering teams. VulnHunter addresses this by incorporating a “falsification engine” that tries to disprove its own findings before a developer ever sees them. After the tool surfaces a potential vulnerability, a structured reasoning workflow hunts for logical gaps, unsupported assumptions, and conditions that would prevent the attack from succeeding.
Capital One CISO Chris Nims said the decision to open-source the tool reflects the need to address a shrinking window before sophisticated AI attack capabilities become affordable and accessible to adversaries.
VulnHunter is one of the most ambitious attempts by a major financial institution to turn AI-powered security testing into a public resource. The tool is designed to integrate into existing CI/CD pipelines, scanning code as part of the build process rather than as a separate post-deployment audit.
This article was adapted from VentureBeat. Read the original here.
