I'm on the fence here, for one as from recent Linux mailing discussions those tools can really find good bugs (51% of them?), but on other side - I'm afraid of false sense of security.
ph3t 4 hours ago [-]
All these security/vulnerability scanning harnesses look more or less the same. Not sure what’s the point of bragging or publishing about them anymore, there’s no moat
skybrian 1 hours ago [-]
I imagine they built it mostly for themselves, but open sourcing it is a nice gesture.
latchkey 23 minutes ago [-]
Chances are that it provides little value to them.
fsuts 3 hours ago [-]
An end product to justify the Billions spent on AI
ActionHank 2 hours ago [-]
Also so that the engineers have something for the resume that looks and sounds impressive.
They don't know that Dario told me Fable is going to hack the planet.
worldsavior 4 hours ago [-]
They're desperate for the hype.
jabroni_salad 17 minutes ago [-]
Vulnhunter isn't that exciting but if you scroll down their feed you'll see "guide to common rust errors" which... also isn't very exciting. I think they just need to publish something every week.
fwiw I have seen good whitepapers from them. A while back I used one about their IVR to get exec buy in for re-doing my company's IVR into something a lot better.
ceejayoz 3 hours ago [-]
Eh, Capital One has long been surprisingly progressive on open source and whatnot. They were one of the first to properly adopt OAuth to connect accounts, too, back when Plaid/Mint/etc. were mostly proxying logins.
IMHO these type of projects are not tools per-se but methodologies. I think this is a better framing since that's exactly what they are - a bunch of markdown files that describe in general terms how to perform an assessment aligned to some principles.
Btw, these type of methodologies are used all the time. Practically every security consultancy has them so adding them to an LLM makes a lot of sense.
bpmct 1 hours ago [-]
Curious if the team at CapitalOne can share in more detail how this tool is being used internally, including how it’s helped their security practices and culture. That would help address some of the legitimacy concerns.
Why does this feel like an exec trying to justify token spend?
bobthebob 2 hours ago [-]
They dont need to justify it.
Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality.
There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
folkrav 5 minutes ago [-]
We also have to stop treating any criticism of some practices surrounding AI adoption like a rejection of the technology.
cute_boi 11 minutes ago [-]
Don’t underestimate how banks operate. Things move very slowly in banking, so they absolutely need to justify it. Many banks still use GPT Mini, and even that requires approval from two levels of management. Even upgrading from Java 8 to Java 17 requires extensive justification.
Forget AI—you even have to justify using a MacBook.
xur17 4 hours ago [-]
> If you intend to use VulnHunter on Anthropic's first-party platforms (Claude API / Claude Code), we strongly recommend enrolling first via the verification portal.
Has anyone actually had success with this? I applied for my company several weeks ago, and never heard back.
AshamedBadger56 4 hours ago [-]
Seems to be very random. I've heard stories like yours, as well as companies who applied and are approved same day.
liampulles 3 hours ago [-]
Wasn't Capital One founded on the premise of massive-scale market and product experimentation? Makes sense that they would design tools that match that approach.
https://github.com/visa/visa-vulnerability-agentic-harness
https://github.com/cloudflare/security-audit-skill
I'm on the fence here, for one as from recent Linux mailing discussions those tools can really find good bugs (51% of them?), but on other side - I'm afraid of false sense of security.
They don't know that Dario told me Fable is going to hack the planet.
fwiw I have seen good whitepapers from them. A while back I used one about their IVR to get exec buy in for re-doing my company's IVR into something a lot better.
https://www.capitalone.com/tech/open-source/
https://developer.capitalone.com/documentation/o-auth
Btw, these type of methodologies are used all the time. Practically every security consultancy has them so adding them to an LLM makes a lot of sense.
this is just a side project though for me
Sorry to say, tokens aren’t going anywhere, people aren’t going to suddenly stop using AI, and this whole paradigm shift of how people are changing how they work - is a full blown reality.
There is no reversal, no “eh we don’t think the tokens/AI are worth it”. Accept the new reality.
Forget AI—you even have to justify using a MacBook.
Has anyone actually had success with this? I applied for my company several weeks ago, and never heard back.
https://github.com/capitalone/VulnHunter/blob/main/vulnhunt/...