VulnHunter
An agentic AI security tool, developed at Capital One, that reasons forward from attacker-accessible entry points to identify which source-code defects are actually exploitable, then runs a falsification pass before reporting a finding.
VulnHunter applies proactive, attacker-first analysis directly to source code instead of the sink-first pattern matching traditional static analysis tools use. Rather than searching backward from a suspicious code pattern for a hypothetical attacker, it begins at potential attacker-accessible entry points such as APIs, network messages and file uploads, and reasons forward to evaluate whether an attacker can actually break through, mapping prospective attack paths and proposing targeted, evidence-backed fixes.
After finding a potential vulnerability, its falsification engine runs a structured reasoning workflow designed to disprove its own finding, searching for flawed assumptions, logic gaps or security controls that would block the attack, so what reaches a user is intended to be a high-priority, actionable defect rather than a flood of false positives.
It is built and optimized for Claude Opus running in Claude Code, requiring the user's own model access, and the project's documentation notes that running it performs dual-use cybersecurity work and recommends enrolling in Anthropic's Cyber Verification Program first.