Capital One open-sourced VulnHunter. Run it on your code.

A bank just handed you its internal application security tooling for free. On July 20, Capital One open-sourced VulnHunter, an agentic code security scanner that reasons like an attacker instead of pattern-matching like a linter. It's Apache 2.0, it's on GitHub, and if you already pay for Claude Code you can point it at your repo this afternoon. For a small shop with no AppSec budget, that's the most useful thing that shipped this week.

What actually happened

Per Capital One's engineering blog, VulnHunter starts where a real attacker would — APIs, network messages, file uploads — and reasons forward through your application logic to work out whether an exploit path actually survives the defenses already in the code. That's the opposite of how a traditional SAST scanner works, and it's why the output is different.

Three parts matter:

• A falsification engine. After VulnHunter finds something, it runs a structured reasoning pass designed to disprove its own finding. False positives are the reason nobody reads scanner output; Capital One built the tool around killing them. CISO Chris Nims framed the whole design around that pain point in SecurityWeek's coverage.
• Attacker-first tracing, not isolated pattern matching.
• Evidence-backed fixes. Each finding comes with what an attacker would gain and a focused code change — plus separate vulnhunter-fix and fix-verify skills.

The requirements are specific: the repo wants Claude Code authenticated with Opus-class access (it currently runs on Claude Opus 4.8), Python 3.12+ for the runtime agent and benchmark harness, and authorization to scan the code. It installs as Claude Code skills via ./install.sh into ~/.claude/skills/, then you invoke /vulnhunt. Capital One says it validated the tool internally across thousands of repositories.

Why free AppSec tooling matters for your business

Most businesses we work with have exactly zero application security process. Not because they don't care — because a real SAST license plus somebody to triage the output costs more than the site earns in a quarter. So the code ships, and the first security review happens after an incident.

VulnHunter changes the math. The license is free. The marginal cost is tokens. The output is meant to be short enough that a developer actually reads it. That is a genuinely different offer than "buy a scanner and hire someone to ignore it."

Two honest caveats. First, it needs a frontier Opus-class model to work — this isn't a tool you run on a cheap model to save money, and the token bill on a large repo is real. Second, Capital One published no benchmark numbers and neither did we find any; "validated across thousands of repositories" is the vendor's own claim about its own code, not a measured false-positive rate. Treat it as a strong first pass, not a certification.

Run it once on your highest-risk repo — the one that touches payments, auth, or customer data. If it finds nothing, you spent an afternoon and some tokens. If it finds something, you just avoided the version of this week where you're writing a breach notice instead.

Sources: Capital One Tech, SecurityWeek, GitHub.