Open-source agentic AI that hunts exploitable vulnerabilities before hackers do
VulnHunter is an open-source, agentic AI security tool released by Capital One under the Apache 2.0 license. Unlike traditional Static Application Security Testing (SAST) scanners that flag suspicious patterns and generate high rates of false positives, VulnHunter reasons like an adversary. It scans source code to identify which defects are actually exploitable, maps prospective attack paths through the codebase, and proposes targeted, evidence-backed fixes — all before code ships to production. Built internally at Capital One and now freely available on GitHub, it supports batch and unattended operation across many repositories via its agent harness, making it suitable for large-scale enterprise security pipelines.
Fully open-source under Apache 2.0 license · Available on GitHub at no cost · No usage limits imposed by Capital One · Self-hosted on your own infrastructure
AI-researched pricing — verify on the official site before subscribing.
Use it for
— Scanning source code for exploitable vulnerabilities before deployment
— Mapping attacker-reachable code paths through complex codebases
— Running batch security scans across large numbers of repositories
— Integrating adversarial security analysis into CI/CD pipelines
Get the most out of it
01Use the vulnhunter-agent runtime for unattended or batch operation across many repositories simultaneously, saving significant manual review time.
02Focus on the attack-path maps VulnHunter generates — these show how an attacker would chain vulnerabilities together, giving you a prioritized fix order beyond simple severity scores.
03Since VulnHunter is self-hosted, run it in an isolated environment with access to your private repos to get the deepest, most accurate analysis of your actual codebase.
04Review the evidence-backed fix proposals critically: VulnHunter reasons like an adversary, so its suggestions are targeted, but always validate remediation against your application's business logic.
05Contribute back to the Apache 2.0-licensed project on GitHub — Capital One actively encourages community involvement, and custom rules or language support can be upstreamed.
