Capital One releases open-source AI tool to find software flaws pre-deployment

Financial services company Capital One released VulnHunter on Thursday, an open-source, agentic AI security tool designed to scan source code for exploitable vulnerabilities. The tool identifies how an attacker could reach these flaws and suggests targeted fixes, aiming to address them before any code is deployed.

The tool, developed in-house and now available on GitHub under an Apache 2.0 license, represents a significant effort by a major financial institution to transform offensive AI capabilities into a public defensive resource. This release comes at a time when security teams are facing a rising tide of new AI threats.

VulnHunter differentiates itself from conventional scanners through an "attacker-first forward analysis" workflow. Instead of flagging code patterns and searching backward, the tool begins at potential entry points like APIs or network messages and reasons forward through the application's logic to identify viable exploit paths.

Furthermore, the tool incorporates a "falsification engine" that attempts to disprove its own findings. After identifying a potential vulnerability, this engine searches for logical gaps or conditions that would prevent an attack. Only findings that survive this process are presented to human reviewers, along with a full explanation of the exploit path and a proposed code fix.

Capital One has a history of open-source contributions dating back to 2014 and has operated as an "open source first" company since 2015. The release of VulnHunter aligns with the company's ongoing investment in software supply chain security and AI-driven defense.