Hunter Agent
SonarQube Hunter Agent is an AI-powered agent that finds broken access control, business logic, and authentication flaws that traditional analysis misses.
SonarQube Hunter Agent is available as a beta feature in the SonarQube Cloud Enterprise plan. For more information on release stages, see Product release lifecycle.
Overview
SonarQube Hunter Agent is part of the Verify phase of the Agent Centric Development Cycle. It runs a deep analysis of your projects to find vulnerabilities that require human-like understanding of the code, then raises them as issues you can triage in SonarQube Cloud.
Broken access control and business-logic flaws don't show up as code patterns. They live in the gap between what your code is meant to do and what it actually does. Static analysis cannot see that gap, so these flaws usually surface only in manual security review. SonarQube Hunter Agent brings that type of review to your projects.
With SonarQube Hunter Agent, you:
find high-impact security flaws that static analysis misses, such as broken access control and business-logic errors
work with findings as regular issues you triage, assign, and track like any other, with no new tool to learn
run the analysis on Sonar's infrastructure, with nothing to install or run locally
The agent works through playbooks: structured, multi-step sequences of specialized prompts that reason through your code the way a security researcher works through a manual code audit.
Each run works in stages: the agent identifies the threat model for the security-relevant parts of your codebase, detects candidate issues, tests them to rule out false positives, and pins each confirmed finding to an exact location in the code.
What it detects
SonarQube Hunter Agent runs a single application security playbook that covers three categories of vulnerability. Note that the following lists of CWEs are not exhaustive.
Broken access control: insecure direct object references (IDOR), missing or incorrect authorization checks, privilege escalation, sensitive data exposure, and cross-site request forgery (CSRF)
CWE-639: Authorization Bypass Through User-Controlled Key (IDOR)
CWE-285: Improper Authorization
CWE-862: Missing Authorization
CWE-863: Incorrect Authorization
CWE-269: Improper Privilege Management
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-352: Cross-Site Request Forgery
Business logic vulnerabilities: skipping required workflow steps, abusing repeatable actions, and missing rate limits
CWE-840: Business Logic Errors (parent category)
CWE-841: Improper Enforcement of Behavioral Workflow
CWE-799: Improper Control of Interaction Frequency
CWE-837: Improper Enforcement of a Single, Unique Action
CWE-770: Allocation of Resources Without Limits or Throttling
Authentication and session management flaws: broken authentication, session fixation, non-expiring sessions, weak password recovery, missing multi-factor authentication (MFA), and brute-force gaps
CWE-287: Improper Authentication
CWE-384: Session Fixation
CWE-613: Insufficient Session Expiration
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-308: Use of Single-factor Authentication
CWE-294: Authentication Bypass by Capture-replay
CWE-307: Improper Restriction of Excessive Authentication Attempts
SonarQube Hunter Agent works with any language supported by SonarQube Cloud.
Reviewing findings
SonarQube Hunter Agent findings appear in your project's regular issue list, alongside your other issues, so you can filter, assign, comment on, and change their status like any other issue. Each enabled project also has a Hunter Agent page that summarizes findings.
Setup
To enable SonarQube Hunter Agent for your organization and projects, see Uncover complex vulnerabilities with AI.
FAQ
Does SonarQube Hunter Agent replace static analysis?
No. It complements Sonar's static analysis. Static analysis handles the vulnerability classes it's built for, such as SQL injection and cross-site scripting (XSS), and SonarQube Hunter Agent adds a layer for logic-level flaws that don't show up as code patterns.
How is it different from runtime tools or pentesting agents?
Runtime tools and AI-assisted pentesting agents probe a running application after deployment. SonarQube Hunter Agent works at the code level, before the code ships, applying the same attacker-perspective reasoning earlier, when a fix costs far less.
Does it run my application?
No. SonarQube Hunter Agent only reads your source code. It doesn't run or attack a running application.
How is it different from Gitar?
Gitar reviews individual pull requests as they're opened. SonarQube Hunter Agent analyzes your projects in depth.
How is it different from the Remediation Agent?
Both are agents, but they work at opposite ends of the cycle. SonarQube Hunter Agent is a Verify feature that finds new vulnerabilities. The Remediation Agent is a Solve feature that proposes fixes for issues you already have. SonarQube Hunter Agent doesn't fix the issues it finds.
Which large language model does it use?
SonarQube Hunter Agent is model-agnostic. It runs on Sonar's Foundation Agent, which currently uses Claude Sonnet and Opus, and Sonar can qualify other models over time. The Foundation Agent keeps results consistent and auditable, whichever model is in use.
Are the results consistent from run to run?
Yes. Consistency is a core design goal. Rather than producing different results on the same project each run, SonarQube Hunter Agent aims for reproducible, auditable output that you can triage, escalate, and report on.
What happens to my code and findings?
Your code and findings stay within your SonarQube Cloud environment. SonarQube Hunter Agent doesn't send your source code to external services beyond the model inference call, which is subject to the same data-handling terms as the rest of the platform. Contact your account team for the full data-handling documentation.
Related pages
Last updated
Was this helpful?