Capital One’s Security Agent Tries to Disprove Its Own Findings

Security scanners already produce more credible-looking alerts than most teams can afford to investigate. On July 16, 2026, Capital One released VulnHunter, an open-source Claude Code workflow that spends part of its budget trying to reject its own findings before a developer sees them. The release matters because that rejection path is part of the product.

VulnHunter starts at attacker-accessible entry points such as APIs, network messages, and file uploads. It traces data forward through the application toward dangerous operations. The first pass produces candidates. Every candidate then enters a mandatory adversarial verification phase before it can appear in the report.

The public verifier prompt gives that phase a blunt instruction: try to DISPROVE each one.

A generic request to reconsider the first answer would be much weaker. VulnHunter's verifier must build a manifest containing every candidate, then produce a verdict row for every item. It searches the whole codebase for defenses the original hunting agents may not have seen. It rechecks production reachability, severity, framework protections, and every call site before downgrading a finding. A false-positive verdict needs file-and-line evidence. Silent omission counts as a verification failure.

The same prompt says that, historically, ~50% of candidate findings are false positives. Treat that figure as a calibration instruction from the VulnHunter team. The repository provides no sample, measurement method, public benchmark, or comparison baseline behind it. Capital One also says it used the tool across thousands of repositories in tens of business areas, which establishes internal deployment scale rather than accuracy.

Only findings that survive the counter-case proceed to reproduction. The workflow asks for an executable proof of concept and a proposed fix, while a separate read-only agent can later verify the remediation. First-pass output stays a hypothesis until the system has accounted for it, argued against it, and produced stronger evidence for escalating it to a human.

A second agentic pass still relies on model judgment. It can miss a defense, invent a convincing reason to dismiss a real vulnerability, or apply the right rule to the wrong execution path. A mandatory counter-case makes the review process visible; it cannot turn probabilistic analysis into proof.

That limitation makes the public implementation useful. The scanner is available under the Apache License 2.0, so teams can inspect the verifier and change its gates. The launch version was optimized for Claude Opus 4.8. Teams get an inspectable review policy, while model compute remains a separate paid dependency.

I would start an evaluation of an AI security tool with its rejected-candidate table. A polished demo can show how many vulnerabilities an agent describes. The rejection path reveals whether it checks shared middleware, follows every call site, records contrary evidence, and notices when a candidate quietly disappears between stages.

Security teams are short on focused developer attention. Raw AI output consumes more of it, even when the prose sounds certain. VulnHunter exposes its rejection path for inspection and makes that path mandatory. Its workflow is worth borrowing while its actual accuracy remains an open empirical question.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com