What happened
Capital One released VulnHunter (July 17, 2026) under Apache 2.0 on GitHub — an agentic AI code-security tool using 'attacker-first forward analysis' (tracing from entry points like APIs/file uploads forward) plus a 'falsification engine' that tries to disprove its own findings before surfacing them to developers, built as a Claude Code skill requiring Claude Opus 4.8.
Why it matters
A major regulated financial institution open-sourcing an internally-validated (thousands of repos, dozens of business units) agentic vulnerability-detection tool is a notable OSS contribution aimed at reducing false-positive fatigue in AI-driven code scanning.
Applicability
AppSec and platform engineering teams using Claude Code should evaluate VulnHunter as an open-source addition to their SAST/vulnerability-triage pipeline.