Many AI code tools work in “find a problem and suggest a diff” mode. For security, that is not enough. A vulnerability is not just a warning line. It is an exploitable path: input, state, privileges, data, and execution flow.
Capital One released VulnHunter, an open-source agentic AI security tool that analyzes source code from an attacker perspective, builds exploitable paths, and helps developers remediate vulnerabilities.
What changed
VulnHunter is interesting less as “another AI bug finder” and more because of its attacker-first framing. The tool treats code not as a static list of smells, but as an attack surface.
That changes the expected output. A security agent should explain how a vulnerability can be used, where the exploitation path runs, and why the patch closes that path.
Why it matters
A normal code assistant may help with mechanical fixes. But in production security, the expensive part is not writing the diff. It is proving that the fix removes the risk and does not create another one.
A mature AI security workflow needs:
- a trace from source to sink;
- a reproducible attack scenario;
- a link between exploit path and patch;
- a check that the fix breaks the exploit;
- an explanation that both developer and reviewer can inspect.
Without that chain, the agent remains a confident recommendation generator. With it, the agent becomes part of the remediation loop.
New Runtime Read
A security agent should prove a patch against a reproducible attack path, not just emit a diff.
The best AI security tools will compete less on warning count and more on causal chain quality. A development team benefits more from fewer signals with a clear exploit narrative and a verifiable fix.