I think it's actually interesting how you can use the same model to both find and falsify the findings
VulnHunter: Capital One's agentic AI code security tool
31–40 of 45 posts
Re: VulnHunter: Capital One's agentic AI code security tool
#32Earlier quoted context omitted.
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
Don’t underestimate how banks operate. Things move very slowly in banking, so they absolutely need to justify it. Many banks still use GPT Mini, and even that requires approval from two levels of management. Even upgrading from Java 8 to Java 17 requires extensive justification. Forget AI—you even have to justify using a MacBook.
[deleted]
Re: VulnHunter: Capital One's agentic AI code security tool
#33I think it's actually interesting how you can use the same model to both find and falsify the findings
you can, but it's better to use a different model or higher effort level at the very least to do the verifying part. (haven't checked to see what it is they are doing exactly), but doing vulnerability validation with the same model and effort you used to find the vulnerabilities isn't going to be a true second set of eyes and the model will likely always just try and justify it was right in the first place. ime, it's better to start with a fresh, clean context and at the very least a higher effort level on the same model. pass the finding(s) to a model that hasn't seen it before and it will judge it with an unbiased perspective.
Re: VulnHunter: Capital One's agentic AI code security tool
#34Why does this feel like an exec trying to justify token spend?
They dont need to justify it. Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality. There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
Why does this feel like an exec trying to justify token spend?
Re: VulnHunter: Capital One's agentic AI code security tool
#35There are few more: https://github.com/visa/visa-vulnerability-agentic-harness https://github.com/cloudflare/security-audit-skill I'm on the fence here, for one as from recent Linux mailing discussions those tools can really find good bugs (51% of them?), but on other side - I'm afraid of false sense of security.
Since you seem informed, can you help me understand how these work.
Are they glorified markdown skill files, or something more?
Re: VulnHunter: Capital One's agentic AI code security tool
#36If there is a pentester here who uses mitmproxy, the security skills below (distilled from 4000 h1 disclosures) might help - https://github.com/instavm/security-skills this is just a side project though for me
Thanks for sharing.
How does your skills comparison to the offering from Capital One, as well,as what Visa published?
Re: VulnHunter: Capital One's agentic AI code security tool
#37If there is a pentester here who uses mitmproxy, the security skills below (distilled from 4000 h1 disclosures) might help - https://github.com/instavm/security-skills this is just a side project though for me
Thanks for sharing. How does your skills comparison to the offering from Capital One, as well,as what Visa published? https://github.com/visa/visa-vulnerability-agentic-harness
The others work on repository or codebase. Mine works on API traffic realtime captured via mitmproxy.
More like a red team.
Re: VulnHunter: Capital One's agentic AI code security tool
#38If there is a pentester here who uses mitmproxy, the security skills below (distilled from 4000 h1 disclosures) might help - https://github.com/instavm/security-skills this is just a side project though for me
I can't imagine claude being able to use any of these without immediately refusing.
Re: VulnHunter: Capital One's agentic AI code security tool
#39Repo will be inactive and obsolete within 12 months.
Re: VulnHunter: Capital One's agentic AI code security tool
#40Open source... Requires Claude Code CLI, authenticated with access to Claude Opus.
So, not Open Source.