🗓️ Publi éen octobre 2026, ce contenu provient du dépôt GitHub public nealbridges/VulnHunter, un fork maintenu de l'outil VulnHunter initialement développé en interne par Capital One et open-sourcé sous licence Apache-2.0. 🔍 VulnHunter est un outil de sécurité applicative agentique basé sur l'IA, conçu pour analyser du code source en adoptant une approche attaquant-first.

Agentic AI security scanner that reasons like an attacker over source code, confirms exploitable flaws with executable PoCs, and drives test-first fixes through hunt, fix, and verify skills.

An AI agent that works on code from the terminal, a scanner that tests vulnerabilities in a sandbox, and an ebook reader: today's GitHub digest ranges from Codewhale and VulnHunter to KOReader.

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code. - capitalone/VulnHunter

Capital One has open-sourced VulnHunter, an AI security tool that finds exploitable code flaws, maps attack paths and helps developers fix vulnerabilities faster.

It may be the weekend, but the AI News doesn't take a day off. AI is infiltrating Warren Buffett and Capital One credit cards and Kylie Jenner's Meta glasses are just creepy.

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code. - capitalone/VulnHunter

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code. - capitalone/VulnHunter

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code. - capitalone/VulnHunter

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code. - capitalone/VulnHunter

Announcing the release of VulnHunter, an open-source AI code security tool with an agentic reasoning workflow developed by Capital One.

The Trump administration is considering an independent AI safety regulator modeled after FINRA, reporting to the SEC. Valar Atomics is raising $1B at a $5B valuation for small nuclear reactors for data centers. AWS apologized for a billing glitch that generated trillions in estimated invoices. Apple and the DOJ are in early settlement talks over a 2024 antitrust suit. Meta is negotiating to lease AI computing power to Anthropic in a deal potentially worth $10B over two years. OpenRouter also draws multibillion-dollar takeover interest.

Der „VulnHunter“ genannte Scanner nutzt agentische Künstliche Intelligenz, um Schwachstellen in Quellcode aufzuspüren – und das aus der Perspektive eines Angreifers.Das unter der Apache-2.0-Lizenz veröffentlichte Tool arbeitet mit einer sogenannten Falsifikations-Engine. Sie simuliert Angriffsmuster und liefert direkt belegbare Gegenmaßnahmen. Voraussetzung für den Betrieb ist Claude Opus 4.8, ein leistungsstarkes KI-Modell. Die Veröffentlichung erfolgte am 16. […] The post GitHub unter Druck: 292 gefälschte Repositories mit BoryptGrab entdeckt appeared first on BornCity.

  Capital One has released VulnHunter, an open-source AI-powered application security tool designed to identify exploitable software vulnerabilities before code reaches production. Published under the Apache 2.0 licence, the framework combines agentic reasoning with code analysis to trace how an attacker could move through an application, determine whether a vulnerability is genuinely exploitable, and generate remediation guidance for developers. Unlike many traditional static analysis tools that begin with suspicious code patterns and work backwards to determine whether they are reachable, VulnHunter adopts what Capital One describes as an attacker-first approach. The framework starts from external entry points such as API endpoints, network message handlers and file upload interfaces before following the application's execution path to assess whether malicious input can successfully bypass existing security controls and reach vulnerable code. A distinguishing component of the framework is its built-in falsification engine. Rather than presenting every suspected issue to developers, VulnHunter attempts to invalidate its own findings by testing assumptions, examining application logic and identifying conditions that would prevent an exploit from succeeding. Findings that fail these internal verification steps are discarded, while validated issues are accompanied by a detailed explanation of the attack path, supporting evidence gathered from the codebase and a proposed code change that developers can review before deployment. Capital One said the current implementation operates within Anthropic's Claude Code environment using Claude Opus 4.8, although the framework has been designed with the flexibility to support additional foundation models and coding environments in the future. The financial institution said it decided to release the project publicly because software supply chains have become increasingly interconnected, making application security a shared challenge rather than one that can be solved by individual organisations. Chris Nims, Capital One's Chief Information Security Officer, said the growing accessibility of AI-driven offensive capabilities has reduced the time defenders have to identify and remediate vulnerabilities before they can be exploited by attackers. By making VulnHunter openly available, the company hopes security researchers and developers will continue improving the framework while strengthening software security across the wider ecosystem. The release builds on Capital One's wider investment in open-source software and secure software development. The company began publishing open-source projects more than a decade ago, later adopting an open-source-first strategy and expanding its participation in community-driven security initiatives. It has since contributed to dozens of public projects and joined the Open Source Security Foundation (OpenSSF) as a premier member to support collaborative efforts around software supply chain security and governance. Capital One also said it evaluated VulnHunter internally across thousands of software repositories spanning multiple business units before its public release. According to the company, the framework helped identify and remediate vulnerabilities more efficiently than previous manual review processes by reducing unnecessary alerts and providing developers with evidence-backed remediation guidance. The announcement comes as organisations increasingly explore AI-assisted approaches to application security in response to the growing use of AI by threat actors to discover software weaknesses, automate exploit development and accelerate attacks. Security teams have also faced persistent challenges with alert fatigue caused by conventional vulnerability scanners that frequently generate false positives requiring extensive manual verification. Capital One believes embedding security analysis directly into the software development lifecycle can help organisations identify exploitable weaknesses earlier, allowing developers to address issues before applications are deployed. As AI continues to reshape both offensive and defensive cybersecurity capabilities, tools that combine contextual code analysis, automated reasoning and actionable remediation may become an increasingly important part of modern secure software development practices.

Announcing the release of VulnHunter, an open-source AI code security tool with an agentic reasoning workflow developed by Capital One.

Capital One liberó VulnHunter gratis: la IA que lee tu codigo como un atacante y caza vulnerabilidades antes que los hackers. Que es y como integrarlo