Capital One has released an internally developed artificial intelligence security tool to the public as open source software. The company calls the program VulnHunter and describes it as a solution for finding and correcting software defects at the code level.
The financial services firm states that the tool differs from traditional vulnerability scanners. According to Capital One, the system uses an agentic reasoning workflow to locate potentially exploitable defects, map prospective attack paths, and suggest targeted code fixes.
Chris Nims, the executive vice president and chief information security officer at Capital One, explained the motivation behind the release in a LinkedIn post. He noted that the tool was built with a developer-first mindset to address the industry problem of overwhelming false positives that slow down daily workflows.
The software is now available on GitHub alongside a quickstart guide, architecture documentation, and example workflows. These resources demonstrate how the tool traces code paths and generates remediations. Users currently require access to Claude Opus 4.8 and a working Claude Code environment to utilize the system.
Capital One emphasized that modern software supply chains are deeply interconnected. The company argued that a single vulnerability in a widely used open-source component can ripple across thousands of enterprises simultaneously. They stated that defensive tools must be widely distributed, tested, and improved to match the codebases they protect.
