{
  "schema_version": "newruntime-agent-readable-v0.1",
  "type": "capability_delta",
  "slug": "attacker-first-remediation-loop",
  "title": "Attacker-first agents turn vuln triage into repair candidates",
  "description": "A security agent can start from attacker-first exploit-path search and prepare a production-code fix instead of following an abstract checklist.",
  "status": "published",
  "observed_at": "2026-07-21",
  "before_capability": "Security review identifies a vulnerability and hands remediation back to humans.",
  "enabling_change": "VulnHunter-style agent reasons from attacker behavior to vulnerable code and repair candidates.",
  "after_capability": "The workflow can move from exploit-oriented analysis to proposed code change faster.",
  "human_consequence": "Security teams get a more actionable review artifact, but still need human approval before code changes.",
  "verification_level": "source-inspected",
  "buildability_class": "B1",
  "bottleneck": "Safe write actions, exploit reproducibility, and review gates are mandatory before this becomes a reusable workflow.",
  "related_shift": "goal-scoped-agent-loops",
  "related_posts": [
    "capital-one-vulnhunter-attacker-first-security-agent"
  ],
  "topics": [
    "security",
    "agents",
    "code-review"
  ],
  "source_urls": [
    "https://medium.com/capital-one-tech/announcing-vulnhunter-ce9784834ca9"
  ],
  "featured": false,
  "routes": {
    "html": "https://newruntime.com/deltas/attacker-first-remediation-loop/",
    "markdown": "https://newruntime.com/deltas/attacker-first-remediation-loop.md",
    "json": "https://newruntime.com/deltas/attacker-first-remediation-loop.json"
  },
  "source_format": "markdown"
}