A second opinion
Visa and Capital One open-sourced AI bug-finders five weeks apart. Both taught the machine to argue against its own findings. Neither ran the code.
16 July 2026
Two of the world’s financial giants open-sourced AI bug-finders this summer. Their tools look nothing alike until you reach the part that decides whether a finding is real — there they do the same thing, and get it wrong the same way.
What they share is doubt: neither trusts its own first pass. Visa’s harness sends a second reviewer to falsify every finding before it’s accepted; Capital One’s applies, in their words, “a structured reasoning workflow specifically designed to disprove its own argument.” Attacking your own conclusion before you ship is exactly right, and rarer than it should be.
But look at who the second reviewer is. In both tools the doubt is reasoning: the same kind of thinking that raised the finding, turned back on itself. It reads and argues; it is not a fresher mind, only the same one asked again. A model that disagrees with itself has not been checked. It has been asked twice, as a practitioner on Hacker News puts it:
validation with the same model … isn’t going to be a true second set of eyes[. The model will] just try and justify it was right in the first place #one-brain
Both companies know the bar. Visa’s president of technology named the challenge: “confirm that an issue is truly exploitable … prove the attack path is closed.” Claims about running code. Yet the verdict is argued rather than run: “[Visa] does not compile, build, or run tests against the patched tree.” Capital One’s engine doesn’t either.
Cybernuke runs the code, settling what argument can’t: is the defect real, and what does it cost. We took Visa’s harness apart when it shipped and found the trap: rigour convinces you of a finding it never ran. Proof is not argued; it’s witnessed at runtime.
Both tools are worth having; arguing down your own findings does thin false alarms. But an argument is not an experiment, however rigorous — both financial giants shipped the one and skipped the other.