Capital One open sourced VulnHunter, an agentic scanner that reasons like an attacker.

A major regulated bank releasing offensive-style security tooling into the open is genuinely unusual, and it gives builders a production-hardened reference rather than a research prototype (Finextra). It landed the same week Google shipped Gemini 3.5 Flash Cyber, a purpose-built vulnerability discovery model pitched as a cheap alternative to large security-specialized models (DeepMind). AI vulnerability discovery just became a product category with at least two credible entrants in seven days.