Capital One open-sources VulnHunter AI tool

Capital One has open-sourced VulnHunter, an AI-driven tool that finds code-level software vulnerabilities and proposes targeted remediations. The company published the code, a quickstart guide, architecture documentation and example workflows on GitHub.

VulnHunter traces code paths, maps prospective attack paths and generates remediation suggestions rather than operating as a passive scanner. Capital One’s release notes describe an “agentic reasoning workflow” the tool uses to identify potentially exploitable defects and to reduce false positives that can slow developer work.

The bank reports that internal use of VulnHunter helped teams identify and remediate vulnerabilities across thousands of repositories spanning tens of business areas.

The public repository requires access to Claude Opus 4.8 and a working Claude Code environment to run the AI components that produce analysis and remediations. The repository includes setup instructions and sample runs that show how the tool traces code paths and recommends fixes.

Chris Nims, executive vice president and chief information security officer, wrote on LinkedIn that VulnHunter was built with a developer-first mindset to address overwhelming false positives and daily workflow friction.

Capital One wrote that modern software supply chains are interconnected and that a single vulnerability in a widely used open-source component can affect thousands of enterprises. The company added, “We’re open-sourcing VulnHunter because no single organization can solve this challenge alone.”

The repository presents examples that highlight problematic code paths and propose specific code changes for remediation. Documentation explains how teams can integrate the tool into developer workflows to reduce manual triage.

Developers and security teams can find the VulnHunter repository on GitHub and use the provided documentation to configure the required Claude tooling before running the AI-assisted components.