Capital One Releases Free AI Security Tool That Hunts Down Code Flaws Automatically

Key points

• Capital One released VulnHunter, a free AI-powered security tool, to the public in 2025.
• The tool scans software code for exploitable weaknesses and proposes targeted fixes automatically.
• Capital One ran VulnHunter internally across thousands of code repositories spanning tens of business areas.
• The tool requires access to Claude Opus 4.8, an AI model from Anthropic, to function.
• Capital One's security chief says traditional scanners bury developers in false alarms; VulnHunter is built to cut that noise.

Capital One has released a homegrown AI security tool called VulnHunter as open-source software, meaning anyone can download, use and improve it for free.

The tool finds vulnerabilities, weaknesses in code that attackers exploit to break in or steal data, and suggests the exact changes needed to fix them. It isn't a passive scanner that dumps a list and walks away.

Chris Nims, Capital One's chief information security officer, said in a LinkedIn post that existing tools create a real operational headache. Security scanners routinely generate enormous volumes of warnings, most of them harmless. That flood of false alarms slows developers and buries the flaws that actually matter.

VulnHunter is built to reason through code the way an analyst would. It traces the paths an attacker might follow through a programme, works out which flaws are genuinely exploitable, then proposes precise fixes rather than generic advice.

Capital One ran VulnHunter across thousands of internal code repositories, spanning tens of business areas, and found it could identify and fix problems quickly at scale. That kind of coverage would typically require a large specialist team working for months. Our 10 July report on security debt found that eight in ten organisations are already sitting on backlogs of unresolved flaws stretching back more than a year, which puts a tool like this in sharper context.

VulnHunter is on GitHub with a quickstart guide, architecture documentation and example workflows. There's a catch: users need access to Claude Opus 4.8, an AI model from Anthropic, and a working Claude Code environment. Neither comes bundled in the free release. Worth noting, given that Anthropic's own tooling has had its share of security issues lately: we covered two separate Claude vulnerabilities in July alone.

Why is a bank giving away its own security software?

Capital One's answer is direct: the threat is too big for any single organisation. Modern software is built from thousands of shared components, libraries that countless companies use at the same time. One flaw in a popular shared component can ripple across thousands of businesses at once. Defensive tools, the bank argues, need to be as widely available and actively improved as the code they protect.

For ordinary people, this release needs no action. It's aimed at developers and security teams. If you build or maintain software, VulnHunter is worth evaluating in your security testing process. The deeper point here isn't the tool itself but the signal: a top-ten US bank now treats its defensive research as something to give away, because keeping it proprietary helps nobody when the underlying software supply chain is shared by everyone.