Why it matters
Capital One released VulnHunter, an Apache-licensed agentic code-security workflow that starts from attacker-reachable entry points, traces prospective exploit paths, tries to falsify its own findings, and proposes evidence-backed code repairs. The initial implementation targets Claude Code with Claude Opus 4.8, and Capital One says it used the tool across thousands of internal repositories.
My takeaway: The falsification step is a useful pattern for reducing speculative AI findings, but internal deployment claims are not an independent benchmark. Pilot the tool in a sandbox, require reproducible exploit evidence and human review of patches, measure false negatives as well as alert reduction, and turn confirmed findings into regression tests.