The rules of software security are changing faster than most defenders can keep pace.

Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software. What once required significant skill and time can now be automated, accelerated, and scaled. The world faces an increasingly short window of time before highly sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary. Across the industry, organizations are racing to prepare for this paradigm shift.

Traditional environmental protections like network segmentation, identity controls, and monitoring remain essential, but are no longer sufficient on their own. The ultimate defense in this new reality requires a shift in approach: organizations need to consider and detect the vulnerabilities in their code and fix them before adversaries can deploy advanced models to discover and exploit them.

At Capital One, we decided that the right response to AI-enabled threats wasn't to wait, but to build cutting-edge AI-driven defenses and put them in the hands of defenders everywhere. 

That’s why we are announcing today the open-source release of VulnHunter, an advanced agentic AI security tool designed to apply proactive, attacker-perspective analysis directly to the source code.

Developed internally at Capital One, VulnHunter is not a traditional, passive vulnerability scanner. It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations.