Capital One open sources VulnHunter AI security tool

Capital One has published VulnHunter as open source on GitHub. The bank made the internal security tool available for outside review and contribution.

VulnHunter is an AI system that analyzes source code to find potentially exploitable defects. It attempts to map multi-step attack paths from an initial entry point to a vulnerable spot in the code, then produces suggested code changes aimed at closing the chain of access.

The tool uses an agentic reasoning workflow to perform its analysis. Rather than listing isolated warnings, VulnHunter traces how an attacker could reach a defect, describes the access or capabilities an attacker would gain, and generates concrete remediation suggestions for engineers to inspect.

Capital One wrote that it ran VulnHunter on its own repositories before releasing the tool publicly. “Before releasing VulnHunter to the community, we ran it on our own code. We were able to identify and remediate vulnerabilities across thousands of repositories, spanning tens of business areas, with speed and efficiency,” the company wrote, adding that the tool’s suggested changes are intended for engineering review rather than automatic deployment.

Making the code public lets developers and security researchers inspect the tool’s workflow, validate its findings and submit improvements. Capital One framed the release as part of an effort to let others examine assumptions in the tool and contribute to its development.

VulnHunter is designed for software teams that want automated, context-aware analysis of code security that includes both vulnerability identification and targeted remediation guidance. The bank published the project on GitHub so external contributors can test detection logic, propose fixes and extend the tool.

The release follows a trend of technology companies publishing internal security tools for external review and collaboration. The repository is available now on GitHub for review, issue reporting and contributions.