---
schema_version: "newruntime-agent-readable-v0.1"
type: "capability_delta"
slug: "attacker-first-remediation-loop"
title: "Attacker-first agents turn vuln triage into repair candidates"
description: "A security agent can start from attacker-first exploit-path search and prepare a production-code fix instead of following an abstract checklist."
status: "published"
observed_at: "2026-07-21"
before_capability: "Security review identifies a vulnerability and hands remediation back to humans."
enabling_change: "VulnHunter-style agent reasons from attacker behavior to vulnerable code and repair candidates."
after_capability: "The workflow can move from exploit-oriented analysis to proposed code change faster."
human_consequence: "Security teams get a more actionable review artifact, but still need human approval before code changes."
verification_level: "source-inspected"
buildability_class: "B1"
bottleneck: "Safe write actions, exploit reproducibility, and review gates are mandatory before this becomes a reusable workflow."
related_shift: "goal-scoped-agent-loops"
related_posts: ["capital-one-vulnhunter-attacker-first-security-agent"]
topics: ["security","agents","code-review"]
source_urls: ["https://medium.com/capital-one-tech/announcing-vulnhunter-ce9784834ca9"]
featured: false
routes: {"html":"https://newruntime.com/deltas/attacker-first-remediation-loop/","markdown":"https://newruntime.com/deltas/attacker-first-remediation-loop.md","json":"https://newruntime.com/deltas/attacker-first-remediation-loop.json"}
source_format: "markdown"
---

# Attacker-first agents turn vuln triage into repair candidates

This delta is useful as a project seed: do not publish an autonomous fix, but
build a read-only or approval-gated workflow that shows the exploit path,
affected code, proposed patch, and evidence.