Capital One releases free AI tool to find software bugs before hackers do

Capital One has released a new open-source tool called VulnHunter that uses artificial intelligence to find security flaws in software code. The tool, now available on GitHub, scans code for vulnerabilities that hackers could exploit, maps out how an attack would work, and suggests fixes. VulnHunter works in three steps. First, it looks at entry points like APIs or file uploads and traces how an attacker might move through the system. Second, it tries to prove its own findings wrong, discarding false alarms before developers see them. Third, it provides a clear explanation and a code fix for any real vulnerability. The release is part of Capital One's effort to improve security after a major data breach in 2019 that affected about 106 million people. The company was fined $80 million and has since invested heavily in open-source security tools. By sharing VulnHunter for free, Capital One hopes to help the entire tech community defend against increasingly sophisticated AI-powered attacks. The tool currently uses Anthropic's Claude AI model but is designed to work with other systems as well.