🔶 VulnHunter：Capital One 的 Agentic AI 代码安全工具

软件安全规则的变化速度，超过了大多数防御者能跟上的步伐。

先进的 AI 模型极大地降低了恶意行为者发现和利用软件漏洞的门槛。曾经需要大量技能和时间的工作，现在可以自动化、加速和规模化。在高度复杂的下一代 AI 攻击能力变得几乎所有对手都能负担并触手可及之前，世界面临的时间窗口正变得越来越短。整个行业中，各个组织都在竞相为这一范式转变做准备。

网络分段、身份控制和监控等传统的环境保护措施仍然必不可少，但仅靠这些已经不够。在这个新现实中的终极防御，需要方法上的转变：组织需要审视和检测其代码中的漏洞，并在对手部署先进模型去发现和利用它们之前加以修复。

在 Capital One，我们决定，应对 AI 驱动的威胁的正确方式不是等待，而是构建前沿的 AI 驱动防御，并将其交到各地防御者手中。

这就是为什么我们今天宣布开源发布 VulnHunter ，一个先进的 Agentic AI 安全工具，旨在将主动的、攻击者视角的分析直接应用于源代码。

VulnHunter 在 Capital One 内部开发，它不是传统的被动式漏洞扫描器。它代表了防御工具的一种转变——利用 Agentic 推理工作流来识别可能被利用的缺陷，绘制潜在攻击路径，并提出高度针对性的代码修复方案。

The rules of software security are changing faster than most defenders can keep pace.

Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software. What once required significant skill and time can now be automated, accelerated, and scaled. The world faces an increasingly short window of time before highly sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary. Across the industry, organizations are racing to prepare for this paradigm shift.

Traditional environmental protections like network segmentation, identity controls, and monitoring remain essential, but are no longer sufficient on their own. The ultimate defense in this new reality requires a shift in approach: organizations need to consider and detect the vulnerabilities in their code and fix them before adversaries can deploy advanced models to discover and exploit them.

At Capital One, we decided that the right response to AI-enabled threats wasn't to wait, but to build cutting-edge AI-driven defenses and put them in the hands of defenders everywhere.

That’s why we are announcing today the open-source release of VulnHunter , an advanced agentic AI security tool designed to apply proactive, attacker-perspective analysis directly to the source code.

Developed internally at Capital One, VulnHunter is not a traditional, passive vulnerability scanner. It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations.