VulnHunter Explained: Clouditera’s AI Vulnerability Hunter

VulnHunter is a new self-hosted platform that uses AI agents to hunt for vulnerabilities in source code. It comes from Clouditera (云起无垠), the Chinese security company that also publishes the SecGPT model. It is not a scanner you point at a URL: it reads code, forms hypotheses about where it is weak, argues each one from both sides, and can try to prove a finding by reproducing it in a sandbox. This page explains what it does, how to run it, and what it does not prove yet. Everything here comes from the VulnHunter repository as of 28 October 2026; PlayCISO is not affiliated with Clouditera and has not benchmarked it.

What VulnHunter is

The README describes it as an "AI-Powered Automated Vulnerability Discovery Agent Platform" and an "open-source AI vulnerability hunting workbench that combines automated target profiling, AI-assisted vulnerability discovery, chat-based investigation, POC/EXP generation and verification, review workflows, and report delivery — all in a self-hosted deployment."

In practice it is a full web application rather than a command-line tool: a React interface, a backend with WebSocket and MCP (Model Context Protocol) support, PostgreSQL, object storage, and isolated Docker workers that do the analysis. The product was called VulnAgent until July 2026.

What it audits

• Source code, uploaded as an archive (zip, tar, tar.gz, up to 2 GB in the UI) or pulled from a Git URL and branch.
• Java bytecode: .jar, .war and .class files are decompiled first, so you can audit a Java app without its source.
• Languages its profiler recognises: JavaScript/TypeScript, Python, Java, Go, PHP, .NET, Rust, Ruby and Scala. Its audit prompts also cover memory-corruption bugs in C/C++-style code.
• Not live black-box targets. Dynamic work happens on a copy of the target that VulnHunter builds itself, locally or in its optional sandbox.

How it works: attacker vs defender

The audit runs on Clouditera's own flow runner, YoungFlow, which orchestrates stages with LangGraph and executes each task with a coding-agent CLI. A scheduler keeps choosing the next stage, which the design docs describe as a "cognition-driven decide spiral" that imitates how an expert auditor works:

1. Onboard: build a profile of the project, a wiki and a threat model.
2. Cognize: skim one area and map its attack surface and trust boundaries.
3. Hunt: read one audit path closely and write down risk hypotheses.
4. Verify: a two-sided argument. One agent (the affirmer) tries to prove the bug is reachable; another (the challenger) looks for evidence that it is not. The verdict is confirmed or refuted.
5. Reproduce (optional): build a proof-of-concept and trigger the bug in a sandbox.
6. Assess and chain (optional): rate one finding's exploit impact, or chain several findings into one exploit.
7. Report.

Between stages the agents write their notes to structured Markdown and YAML files (the wiki, audit paths, hypotheses, bugs), because, as the docs put it, a single context window "cannot hold the analysis of a complex project." Importantly, the docs treat statically confirmed findings as candidates: a finding only counts as reproduced once the proof-of-concept succeeds.

What is not inside: there is no classic static-analysis engine (no Semgrep, CodeQL or Joern) and no dedicated fuzzer. The reasoning is done by the language model; the agent may write its own test harness during sandbox reproduction.

What you get out

Each finding is a report with a title, vulnerability type, CWE, a CVSS 3.1 vector and score, an exploit-value score and priority, affected versions, code anchors, a step-by-step trace from where untrusted data enters (the source) to where it does damage (the sink), a suggested fix, and references, plus a proof-of-concept package when reproduction ran. The interface adds a dashboard, token-usage tracking, a four-state review workflow for each finding, a chat assistant with "16+ MCP tools", and Markdown report export. We found no SARIF export.

Which AI models it needs

You bring your own. VulnHunter accepts OpenAI-compatible and Anthropic-compatible APIs, with presets for OpenAI, OpenRouter, Together, Baseten, DeepSeek, Zhipu GLM and Qwen, and it works with self-hosted models. The README recommends no specific model. One thing to decide up front: your source code goes to whichever model provider you configure. For proprietary code, either accept that provider's data terms or self-host the model.

How to install it

There are no published container images, and the README is blunt that "a bare clone followed by docker compose up is not an installation." You build a release from source:

git clone --recurse-submodules https://github.com/Clouditera/VulnHunter.git
cd VulnHunter
pnpm install --frozen-lockfile
./scripts/build-release.sh --edition community
VERSION=$(node -p "require('./package.json').version")
cd "release/vulnhunter-release-${VERSION}-community"
./install.sh
./doctor.sh
# then open http://localhost:23000 and create the admin account

Requirements: x86_64 Linux (Ubuntu 22.04+ recommended), Docker with Compose v2, Node 20+ and pnpm 9+. The README asks for 16 GB of RAM or more, but its own environment-requirements document says at least 32 GB of RAM and 100 GB of disk, so plan for the larger figure. No GPU is needed unless you host the model yourself. The sandbox is a separate install, and its QEMU profiles need /dev/kvm.

What it does not prove yet

• No benchmark, no CVEs. The repository contains no accuracy figure, dataset result or CVE list. Its "Why VulnHunter?" table compares itself favourably with SAST ("context-aware analysis" versus "high false positives"), but nothing is measured.
• The licence is labelled three ways. The LICENSE file is Apache-2.0 plus conditions that forbid offering it as a hosted service to others without a commercial licence and require keeping its branding. GitHub's About box and the package.json both say AGPL-3.0. Either way it is source-available, not OSI open source, and the Community edition is single-user (multi-user access control is in the proprietary enterprise add-on).
• Young and small. 89 stars and 18 forks, first commit 20 April 2026, last commit 28 September 2026, no GitHub releases, and three different version numbers across the README, package.json and git tags.
• Docs are partly in Chinese. The main README is in English; the flow design docs, prompts, release notes and deployment guides are in Chinese.
• Open-ended cost. Token spend depends on the size of the code and how many stages you enable. The platform tracks usage but gives no per-scan estimate.
• Isolation depends on you. The agent's prompt treats exploit work inside the configured target and sandbox as authorised. Without the sandbox, dynamic steps run on the local worker, so deploy it on an isolated host.

How it compares

VulnHunter's closest peers are the code-aware AI pentesters (Strix, Shannon) and OpenAI's Aardvark, now Codex Security. What sets it apart is being code-first with Java decompilation, a full team-style workbench with review states, the ability to chain findings, and first-class support for Chinese models. Where it trails is proof, adoption and licence clarity. The full side-by-side of 20 tools, AI and classic, is on our pentest tools comparison.

Should you use it?

If you want a self-hosted, reasoning-driven code audit with a review workflow, and especially if you want to use GLM, Qwen or DeepSeek, VulnHunter is worth a trial on a codebase whose vulnerabilities you already know, so you can measure what it finds and what it misses. Keep a deterministic SAST engine such as Semgrep or CodeQL in CI either way: it is cheaper, repeatable and covers the basics on every pull request. Do not report its findings to anyone, a vendor or an open-source maintainer, until a person has reproduced them. And only run it on code you own or are authorised to test, as its own README requires.

FAQ

Is VulnHunter open source?

Not in the OSI sense: it is Apache-2.0 plus conditions that forbid hosting it as a service for others without a commercial licence and require keeping its branding, while GitHub and package.json say AGPL-3.0. Check with Clouditera before building on it. Internal use in one organisation is allowed.

Does VulnHunter scan live websites?

No. It starts from source code or Java bytecode, and its dynamic stage runs the target in its own sandbox. For live web apps, look at ZAP, Burp Suite, Strix or Shannon.

Which AI models does it use?

Your own: OpenAI- or Anthropic-compatible APIs, with presets including DeepSeek, GLM and Qwen, or a self-hosted model. Your code goes to that provider.

How accurate is it?

Unknown. No benchmark, dataset result or CVE list is published.