Capital One has released Vuln Hunter, an open‑source agentic AI tool that proactively scans source code for exploitable defects.

Unlike passive scanners, Vuln Hunter uses a falsification engine to challenge its own conclusions, reducing false positives before they reach developers. It adopts an attacker‑first forwardמ analysis, simulating real attack paths from entry points such as APIs and file uploads, and produces evidence‑backed remediation suggestions.

The tool is built with a developer‑first mindset, minimizing friction and focusing on immediate, actionable code repair. It requires Claude Opus 4.8 and a working Claude Code environment. The repository on GitHub includes a quickstart, architecture docs, and a roadmap for community contributions. By open‑sourcing the framework, Capital One invites the broader security community to inspect, improve, and extend this evidence‑driven defensive approach.