ทันเอไอ

Capital One launches VulnHunter: An open-source AI agent for vulnerability scanning with a hacker-mindset to reduce false positives

Financial giant Capital One has released an open-source cybersecurity tool powered by advanced AI agents, designed to help developers identify and fix code vulnerabilities with higher precision.

Financial services leader Capital One has open-sourced its latest security tool, "VulnHunter." The tool leverages Agentic AI to enhance software vulnerability detection by shifting away from traditional static analysis.

Unlike conventional SAST (Static Application Security Testing) tools, VulnHunter employs an "Attacker-First Forward Analysis" approach. Instead of scanning for broad patterns of dangerous code, it starts from entry points accessible to attackers, such as APIs or network interfaces, and simulates attack paths to determine if a potential vulnerability is actually exploitable. This significantly reduces noise and irrelevant alerts.

VulnHunter also features a "Falsification Engine," which cross-verifies findings by attempting to disprove them. By proactively filtering out false positives before notifying developers, the tool ensures higher reliability and provides actionable remediation guidance.

Designed to integrate with frontier AI models like Claude Opus, VulnHunter’s move to open source aims to foster community collaboration and drive innovation in security tooling. The source code and documentation are now available on GitHub.