VulnHunter
Agentic AI security scanner that hunts exploitable source code vulnerabilities and generates executable PoCs.
Harness-agnostic AI agent that simulates attack paths and verifies defects in sandboxed environments.
VulnHunter is a harness-portable AI security scanner designed for application security teams and code auditors. Instead of simple pattern matching, it acts like an adversary by tracing attack paths, eliminating false positives, and generating verifiable proof-of-concept exploits. You bring your own reasoning LLM and execution environment.
What it is
The tool scans source code from the input surface forward to discover exploitable vulnerabilities rather than guessing based on static patterns. It executes an adversarial verification pass that filters out unexploitable code paths and outputs executable PoCs. This maintained fork adds cross-harness support and containerized validation routines to standard AI agent workflows.
Who it's for
It suits application security engineers, red teams, and developers who want automated, proof-backed vulnerability hunting across their codebase. It is not suitable for organizations seeking a simple plug-and-play SAST scanner without self-managed LLM infrastructure or container execution rights. It requires comfortable management of AI agent harnesses and local environment variables.
Key features
Harness-Portable Architecture
Runs on any AI agent harness supporting subagents and custom skills via standard environment contracts.
Adversarial Verification Pass
Filters out false positives by attempting to litigate and prove exploitability before writing final report findings.
Sandboxed Exploit Execution
Proves vulnerability severity using containerized Docker runtimes to test generated proof-of-concept payloads.
Unattended Operator Skill
Includes vulnhunter-run to clone repos, execute scans, write manifests, and enforce strict stop rules automatically.
Up and running in 3 steps
Our honest verdict
What's great
- Filters out up to 55% of false positives through adversarial verification before delivering reports.
- Executes proof-of-concept tests in Docker sandboxes instead of relying solely on static trace guesses.
- Decoupled from specific vendor platforms to run on any compatible AI agent harness.
- Automates end-to-end repository hunting loops for scheduled nightly security workflows.
Where it falls short
- Requires you to host and pay for strong open-weight or commercial reasoning LLMs.
- Dual-use capability can trigger rate limits or safety flags on commercial LLM providers.
- Setup requires configuring environment paths, Docker sandboxing, and agent harness binaries.
Pricing & license
VulnHunter is free to use under the Apache-2.0 license. The only operational cost comes from running your own Docker infrastructure and supplying API keys or compute resources for your chosen reasoning LLM.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Does VulnHunter require Claude Code?
No, this maintained fork explicitly decouples the original Capital One release from Claude Code so you can run it on any compatible agent harness.
Which LLMs work best with VulnHunter?
It requires a strong reasoning model, ideally uncensored or abliterated open-weight models that will not trip dual-use safety filters during exploit generation.
How does it reduce false positives?
It applies an adversarial verification pass to confirm exploitability and run PoCs against sandboxed containers before confirming a finding.
