An open-source AI security tool applies attacker-perspective reasoning and self-validation to detect and remediate software vulnerabilities across large codebases.
VulnHunter is an open-source tool by Capital One which utilises AI to spot and fix software flaws prior to exploitation. Instead of using only traditional static analysis, the tool adopts an attacker’s perspective to identify potential exploits paths to find possible exploit paths and validate security issues. Released under the Apache 2.0 Licence and optimised for Claude Opus 4.8, VulnHunter was already tested on thousands of software repositories.
In contrast to traditional vulnerability scanners, which frequently produce false positives, the VulnHunter uses a falsification engine to validate its findings. The tool is looking for logical inconsistencies in the exploit chain, ensuring the detected weaknesses are exploitable, and only focusing on fixes that have enough evidence to support them. Additionally, VulnHunter can simulate the attacker’s actions through reasoning based on potential access points, such as application programming interfaces (APIs).
According to Capital One, VulnHunter was first tested internally in the company’s software infrastructure and then released to the public. While undergoing validation, the tool was able to detect and remediate thousands of vulnerabilities in various repositories and business areas. The company claims that with the help of an automated workflow the tool reduced the time required for manual vulnerability investigation and remediation.
The VulnHunter has been designed with a developer-first approach and thus integrates into development workflows as a Claude Code skill. The tool conducts attacker-first forward analysis, which simulates the way malicious entities might interact with application logic and data flow. The project can be found on GitHub and is licensed as an Apache Licence 2.0, which means developers can contribute improvements and add reasoning workflows for new AI models beyond what is provided in the initial release.
The tool is intended to complement, rather than replace, existing application security processes. VulnHunter could run alongside dependency analysis, software composition analysis, secret detection, dynamic testing, threat modeling, and manual security review. Capital One has noted other open projects in this space including Foundry Security Spec for agentic security evaluation and CodeGuard for secure-by-default AI-assisted software development.
With a combination of attacker-perspective reasoning and self-validation, VulnHunter demonstrates how AI tools may improve the safety of software and reduce the need for manual checks. By making the tool open-source, organisations have an opportunity to use the framework, evaluate its performance, and provide improvements.
