Capital One open-sourced VulnHunter. It is an agentic AI security tool for proactive attacker-first source code analysis. It simulates attacker paths forward from entry points instead of backward from sinks. A falsification engine discards findings that rely on unsupported assumptions. It provides evidence-backed remediation with exploit demos and code fixes. The tool runs as three composable Claude Code skills: hunt, fix, and verify. A headless runtime agent enables CI/CD integration. A local harness supports batch scanning and benchmarking. It requires Claude Opus and Claude Code. Users must enroll in Anthropic’s Cyber Verification Program for Anthropic platforms. The repository is Apache 2.0 licensed.
What it unlocks
Running attacker-first vulnerability analysis directly on source code with Claude Opus in Claude Code.
- 1.1k GitHub stars
- 155 forks
- 26 commits
What you need to act on it
- Claude Code CLI installed
- Claude Opus model access
- Python 3.12+ for runtime and harness
- Anthropic Cyber Verification Program enrollment for Anthropic platforms
Sources