Open-source agentic AI that hunts exploitable vulnerabilities before hackers do
VulnHunter is an open-source, agentic AI security tool released by Capital One under the Apache 2.0 license. Unlike traditional Static Application Security Testing (SAST) scanners that flag suspicious patterns and generate high rates of false positives, VulnHunter reasons like an adversary. It scans source code to identify which defects are actually exploitable, maps prospective attack paths through the codebase, and proposes targeted, evidence-backed fixes — all before code ships to production. Built internally at Capital One and now freely available on GitHub, it supports batch and unattended operation across many repositories via its agent harness, making it suitable for large-scale enterprise security pipelines.
Fully open-source under Apache 2.0 license · Available on GitHub at no cost · No usage limits imposed by Capital One · Self-hosted on your own infrastructure
AI-researched pricing — verify on the official site before subscribing.
Use it for
— Scanning source code for exploitable vulnerabilities before deployment
— Mapping attacker-reachable code paths through complex codebases
— Running batch security scans across large numbers of repositories
— Integrating adversarial security analysis into CI/CD pipelines
Get the most out of it
01Use the vulnhunter-agent runtime for unattended or batch operation across many repositories simultaneously, saving significant manual review time.
02Focus on the attack-path maps VulnHunter generates — these show how an attacker would chain vulnerabilities together, giving you a prioritized fix order beyond simple severity scores.
03Since VulnHunter is self-hosted, run it in an isolated environment with access to your private repos to get the deepest, most accurate analysis of your actual codebase.
04Review the evidence-backed fix proposals critically: VulnHunter reasons like an adversary, so its suggestions are targeted, but always validate remediation against your application's business logic.
05Contribute back to the Apache 2.0-licensed project on GitHub — Capital One actively encourages community involvement, and custom rules or language support can be upstreamed.
A defensive stack that monitors AI system outputs, detects potential regulatory violations, and auto-generates compliance documentation before regulators come knocking. Combines real-time content analysis with automated anonymization and audit trails.
How the workflow runs
01anonymizer-ner — Automatically detect and redact PII from all AI-generated outputs before storage or distribution
02vulnhunter — Scan AI system prompts and responses for potential safety vulnerabilities or jailbreak attempts
03gemini-agent — Generate compliance reports and flag potential regulatory issues across enterprise AI deployments
04gsc-mcp-server — Track public-facing AI content performance and detect reputational risks
05copilot-in-power-bi — Build real-time compliance dashboards showing AI usage patterns and risk metrics
As eight states sue OpenAI and regulatory scrutiny intensifies, this stack creates an automated compliance moat. Legal teams can demonstrate proactive governance, and enterprises can deploy AI with confidence knowing every interaction is logged, sanitized, and auditable. The combination of NER anonymization with vulnerability scanning catches issues before they become lawsuits.
Total (5 tools)$260/mo
For Security engineer at a company using open-weight models
A security-first development workflow for organizations deploying open-source AI models. Scans codebases for vulnerabilities, tests models for adversarial robustness, and maintains air-gapped deployment options to address export control concerns.
How the workflow runs
01spiral-coder — Build and test AI features entirely on local hardware, ensuring no code leakage to cloud providers
02vulnhunter — Hunt for exploitable vulnerabilities in the AI-generated code before deployment
03laguna-s-2-1 — Use the secure open-weight coding model for generating additional test cases and security patches
04tabnine — Enable privacy-first code completion that learns from your secure codebase without cloud transmission
05inspect-ai — Rigorously evaluate model outputs for safety, bias, and adversarial resistance
With open-source AI facing potential export controls and licensing requirements, this stack lets teams prove security due diligence. Spiral-coder's local-first approach combined with VulnHunter's exploit detection creates a defensible security posture. Perfect for defense contractors, government agencies, and enterprises in regulated industries who need open models but can't risk security breaches.
