Taylor Luttrell-Williams on Finding Logic Vulnerabilities with SonarQube Hunter Agent

I’m Taylor Luttrell-Williams, and I create developer content at Sonar, the makers of SonarQube. SonarQube Hunter Agent is an AI security agent intended to find classes of vulnerabilities that traditional static application security testing, or SAST, cannot catch before attackers do.

In the agentic era, code is shipping at both agentic velocity and agentic volume. I argue that more vulnerabilities are reaching production as a result. Traditional pattern-based scanners are useful at detecting patterns, but some issues are about intent rather than a recognizable pattern in the code.

A logic-level vulnerability can exist even when the code is functionally valid. The problem is that its behavior contradicts the intended business logic. A scanner designed around conventional patterns may not recognize that the application is doing something its designers did not intend.

Many companies run penetration tests only once or twice a year, or perhaps quarterly. With attackers using better models and changes shipping more frequently, I believe teams need another way to detect these vulnerabilities and address them between tests.

Hunter Agent first maps the repository globally. That map guides three specialized agents, each investigating a class of issue and the relationships among components. They try to establish the security expectations of the application rather than evaluating each piece of code in isolation.

The system then uses adversarial validation to check whether its leads are genuine and applies noise gates to reduce low-validity or intentional behavior reported as an issue. These playbooks handle the agent orchestration and produce findings that developers can be assigned to address.

For each finding, the product assigns a severity, describes its potential impact and points to the relevant location in the codebase. For existing SonarQube users, Hunter Agent issues appear alongside findings from its SAST tool, in the same issue workflow.

As the time between discovering and weaponizing a vulnerability shrinks, security teams need tools that can keep pace. Sonar is joining OpenAI’s Daybreak Cyber Partner Program; we expect it to bring governed access to advanced cybersecurity frontier models into products including Hunter Agent.

The playbooks run across the whole codebase, and Sonar says each lead is investigated and validated before it appears. We use the additional reasoning to make findings precise, repeatable and auditable. Our recommended approach combines Hunter Agent with SAST and software composition analysis as independent layers of security.

For the demonstration, I scanned a simple Python application in SonarQube Cloud. The Hunter Agent page offers an on-demand scan and estimates the units needed for a deep pass over the project. The product also works with the self-hosted SonarQube Server.

A scan can take more than an hour depending on the size and complexity of the project, so I ran this one in advance. It securely clones the target repository, maps the application architecture and attack surfaces, builds a threat model, and then runs contextual scans across the codebase.

The specialized agents look for issues such as insecure direct object references, broken access control and business logic flaws. Their findings are aggregated and deduplicated, and validated vulnerabilities are logged in the existing SonarQube issue list.

The example scan shows 46 open issues across three categories: broken access control, business logic, and authentication and session issues. The dashboard lets me open the results for a category and inspect individual findings in the same place as other SonarQube issues.

Broken access control can include insecure direct object references, missing authorization checks, privilege escalation, sensitive data exposure and cross-site request forgery. Business logic problems include skipped workflow steps, repeatable actions that can be abused, and missing rate limits.

Authentication and session findings can cover broken authentication, session fixation, sessions that do not expire, weak password recovery, missing multi-factor authentication and gaps that allow brute-force attempts. In the example, I open a high-severity access-control finding tagged as a Hunter Agent issue.

The issue view points to the affected code, explains the problem and suggests how to fix it. In this example, a signed-in user can write their own role field and thereby pass an admin access check. The check itself may look correct in isolation, but it relies on a field the user can change.

Issues begin in an open state and can be assigned to developers. A team can accept a valid issue without having it affect the quality gate, confirm it so that it does affect the gate, or mark it as a false positive after review.

A second high-severity finding concerns a user who can reach protected routes, including admin functions, with only an account password and without completing multi-factor authentication. Again, the issue page shows the location, why it matters, possible fixes and the activity associated with the finding.

Hunter Agent can run on demand or on a schedule. The schedule is configurable by frequency, such as daily, weekly or monthly, and a team can choose a branch rather than scanning the main branch every time.

Besides suggesting fixes for these business-logic-level vulnerabilities, Sonar is introducing automatic remediation. Issues can be assigned to a separate SonarQube remediation agent, which can perform remediation on a schedule. The aim is to help teams find these flaws before attackers do.