Sonar launches Hunter Agent to find flaws code scanners can’t see
Artificial intelligence code verification and governance company SonarSource Sàrl today released SonarQube Hunter Agent, an AI agent built to find security flaws that pattern-based scanning cannot see.
The vulnerabilities it targets are the ones where the code does exactly what it was written to do. A user opens another customer’s records. A checkout step gets skipped. A session stays alive long after it should have expired.
Nothing in the source reads as broken, because at the level a scanner works, nothing is. Only someone who knows what the feature was meant to do can see the problem.
So the work has gone to people. A security engineer reads the code by hand, and when the budget stretches, a penetration tester goes at the running application from outside. Both cost money, both take time and both are out of date as soon as new code ships. Sonar said the shrinking gap between release and exploitation has made that a bigger problem than it used to be, with AI-assisted development pushing code out faster than any audit cycle can follow and logic flaws going unnoticed for months at a time.
