Vulnerabilities Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool The agentic security tool identifies potentially exploitable code flaws, traces attack paths, and recommends targeted remediations. By Mike Lennon | July 20, 2026 (6:25 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Financial services giant Capital One has released an internally developed AI-powered security tool to the public as open source. Dubbed “ VulnHunter ”, the tool was designed to find and fix software vulnerabilities at the code level, but Capital One says it is not a traditional, passive vulnerability scanner. “We designed VulnHunter with a developer-first mindset to solve a massive industry pain point: overwhelming false positives that create friction and slow down daily workflows,” Chris Nims, EVP & Chief Information Security Officer (CISO) at Capital One explained in a LinkedIn post. “It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations,” the company says. Available on GitHub , along with a quickstart guide, architecture documentation, and example workflows showing how the tool traces code paths and generates remediations, users currently need access to Claude Opus 4.8 and access to a working Claude Code environment. “Modern software supply chains are deeply interconnected. A single vulnerability in a widely-used open-source component can ripple across thousands of enterprises simultaneously. We’re open-sourcing VulnHunter because no single organization can solve this challenge alone,” Capital One said. “The defensive tools to address this reality need to be just as widely distributed, tested, and improved as the codebases they protect.” Advertisement. Scroll to continue reading. Capital One said that, when using VulnHunter internally, it was able to quickly and efficiently identify and remediate vulnerabilities across thousands of repositories, spanning tens of business areas. Written By Mike Lennon For more than 15 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is founder and director of several leading cybersecurity industry conferences around the world. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Mike Lennon CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws Keyfactor Scores $1 Billion+ Investment for AI, Post-Quantum Security SecurityWeek ICS Cybersecurity Conference Heads to Nashville for Special 25-Year Anniversary Edition Cisco Moves to Acquire Astrix Security to Tackle Non-Human Identity Risks Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks Senate Confirms Joshua Rudd to Lead NSA and US Cyber Command US Cyber Strategy Targets Adversaries, Critical Infrastructure, and Emerging Technologies Zscaler Acquires Browser Security Firm SquareX Latest News Hugging Face Hacked in Autonomous AI Attack Chrome 150 Update Patches Severe Memory Safety Bugs WP2Shell WordPress Vulnerabilities Exploited in the Wild In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive Beacon Security Raises $13 Million for Security Data Platform Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Why Email Security Keeps Failing (And What Has to Change) July 8, 2026 Join this live webinar as we break down why email-layer defenses alone can't keep pace with the modern phishing ecosystem, how agentic AI is changing the capacity equation for security teams, and more. Register Virtual Event: 2026 Cloud Security Summit July 15, 2026 This year's summit will help organizations learn how to utilize tools, controls, and design models needed to properly secure cloud environments. Interact with leading solution providers and other end users facing similar challenges in securing a variety of cloud deployments. Register People on the Move Jazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO. AJ Shipley has been appointed Chief Product Officer at CrowdStrike. Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product. More People On The Move Expert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email