Sonar Launches SonarQube Hunter Agent to Catch Logic-based Security Flaws

New AI security agent finds the broken access control, business-logic, and authentication vulnerabilities pattern-based scanning was never built to catch, in the SonarQube workflow teams already use

Sonar, a global leader in AI code verification and governance, announced the general availability of SonarQube Hunter Agent, an AI-powered security agent built to catch high-impact vulnerabilities that traditional pattern-based scanning was never designed to find.

Closing the gap

Deterministic scanning is excellent at catching flaws that look wrong in the code, including injection vulnerabilities, unsafe data flows, and insecure patterns. However, some vulnerabilities aren’t detectable in the code itself; they’re visible only when you understand what the code is supposed to do. Examples include things like a user who can view another customer’s records, a checkout flow that can be skipped, or a session that doesn’t expire the way it should. In these examples, the code technically runs exactly as written, but it permits something it was never meant to allow.

Traditionally, identifying these types of issues required manual security review or a penetration test. Both of these options are expensive, slow, and ultimately out of date the moment new code ships. As AI-assisted development accelerates the pace of shipping code, the window between release and exploitation is shrinking fast. Catching issues before code ships is now essential to staying ahead of the attackers.

Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX

What Hunter Agent does

SonarQube Hunter Agent analyzes a project’s entire codebase to find three categories of flaws that require reasoning, not pattern-matching: broken access control, business-logic vulnerabilities, and authentication or session-management issues.

The agent works the way a human security researcher would, by tracing how code, data, and identity move through a system, then investigating and confirming each candidate issue before it ever reaches a developer. Verified findings land directly inside the SonarQube workflow, next to the rest of a team’s issues. This means that security and development teams triage, assign, and track without learning a new tool or switching context.

Because it runs in the background, on a set schedule or on demand, SonarQube Hunter Agent never blocks a pull request or slows down CI/CD. Further, as every finding is confirmed before it surfaces, teams spend their time on real risk instead of sorting through noise.

SonarQube Hunter Agent is designed to complement SonarQube’s existing SAST, not replace it, extending Sonar’s zero-trust, multilayered verification philosophy. It plugs the logic flaw blind spot SAST was never designed to cover. Where SAST catches flaws in how code is written, Hunter Agent catches the flaws in what code is meant to do.