Curious if the team at CapitalOne can share in more detail how this tool is being used internally, including how it’s helped their security practices and culture. That would help address some of the legitimacy concerns.
VulnHunter: Capital One's agentic AI code security tool
21–30 of 45 posts
Re: VulnHunter: Capital One's agentic AI code security tool
#22All these security/vulnerability scanning harnesses look more or less the same. Not sure what’s the point of bragging or publishing about them anymore, there’s no moat
I imagine they built it mostly for themselves, but open sourcing it is a nice gesture.
Re: VulnHunter: Capital One's agentic AI code security tool
#23Re: VulnHunter: Capital One's agentic AI code security tool
#24There are few more:
https://github.com/visa/visa-vulnerability-agentic-harness
https://github.com/cloudflare/security-audit-skill
I'm on the fence here, for one as from recent Linux mailing discussions those tools can really find good bugs (51% of them?), but on other side - I'm afraid of false sense of security.
Re: VulnHunter: Capital One's agentic AI code security tool
#25All these security/vulnerability scanning harnesses look more or less the same. Not sure what’s the point of bragging or publishing about them anymore, there’s no moat
They're desperate for the hype.
Vulnhunter isn't that exciting but if you scroll down their feed you'll see "guide to common rust errors" which... also isn't very exciting. I think they just need to publish something every week.
fwiw I have seen good whitepapers from them. A while back I used one about their IVR to get exec buy in for re-doing my company's IVR into something a lot better.
Re: VulnHunter: Capital One's agentic AI code security tool
#26seems weird to not include shell scripts.
https://github.com/capitalone/VulnHunter/blob/main/vulnhunt/...
Re: VulnHunter: Capital One's agentic AI code security tool
#27Why does this feel like an exec trying to justify token spend?
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
Don’t underestimate how banks operate. Things move very slowly in banking, so they absolutely need to justify it. Many banks still use GPT Mini, and even that requires approval from two levels of management. Even upgrading from Java 8 to Java 17 requires extensive justification.
Forget AI—you even have to justify using a MacBook.
Re: VulnHunter: Capital One's agentic AI code security tool
#28Why does this feel like an exec trying to justify token spend?
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
We also have to stop treating any criticism of some practices surrounding AI adoption like a rejection of the technology.
Re: VulnHunter: Capital One's agentic AI code security tool
#29Earlier quoted context omitted.
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
Don’t underestimate how banks operate. Things move very slowly in banking, so they absolutely need to justify it. Many banks still use GPT Mini, and even that requires approval from two levels of management. Even upgrading from Java 8 to Java 17 requires extensive justification. Forget AI—you even have to justify using a MacBook.
You’re correct, but in the span of time - they are just doing the same thing everyone else is doing in many industries, just way slower
Re: VulnHunter: Capital One's agentic AI code security tool
#30Earlier quoted context omitted.
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
We also have to stop treating any criticism of some practices surrounding AI adoption like a rejection of the technology.
True, but this post in about Capital One.
It doesn’t take a genius or system architect to figure out AI use in banking both internally and for consumers is a huge benefit especially for capital one.
Maybe we should critique the actual agentic products they are creating rather than critique the entire AI spend.