> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-server/user-guide/issues/with-ai-features/hunter-agent-findings.md).

# Hunter Agent findings

View and work through the findings the SonarQube Hunter Agent raises on SonarQube Server 2026.5.

The SonarQube Hunter Agent runs a deep AI-powered analysis to find vulnerabilities that require human-like understanding of the code, such as broken access control and business-logic flaws, then raises them as issues you triage like any other.

The Hunter Agent is available in the Enterprise and Data Center editions and requires a separate subscription. An instance administrator sets it up before you can use it. See [Hunter Agent](/sonarqube-server/instance-administration/ai-features/hunter-agent.md).

To learn what the agent detects and how it works, see [Hunter Agent](/agent-centric-development-cycle/in-your-long-living-branches-the-code-maintenance-loop/hunter-agent.md).

## Viewing findings <a href="#viewing-findings" id="viewing-findings"></a>

Each project bound to a repository has a **Hunter Agent** page in its navigation. This page gives you a results overview: the count of open, confirmed, and accepted findings, and a breakdown by vulnerability category (broken access control, business logic, and authentication and session management).

Select the issues in one of the findings tiles on the **Hunter Agent** page to open the project's **Issues** page filtered to Hunter Agent findings. Each category count links to the issues for that category. On the **Issues** page, filter by tag to see all agent findings or focus on one category:

* `hunter-agent`: all Hunter Agent findings
* `hunter-broken-access-control`: broken access control findings
* `hunter-business-logic`: business-logic findings
* `hunter-auth-session`: authentication and session management findings

Each finding is raised as a vulnerability with a security software quality and an estimated severity, and includes an explanation with **Why is this an issue?** and **How to fix it?** sections. Findings start as **Open**. **Confirm** a finding to mark it as a valid issue to fix, or **Accept** it to acknowledge it without fixing it right away. Open and confirmed findings may affect the quality gate; accepted findings do not. You review, assign, and comment on these findings like any other issue.

AI CodeFix is not available for Hunter Agent findings.

If your project has not run a Hunter Agent analysis yet, project administrators should read [Hunter Agent](/sonarqube-server/project-administration/ai-features/hunter-agent.md#first-analysis-recommendations) before the first run, so the first wave of findings does not fail the main branch's quality gate.

## Fixing findings with the Remediation Agent <a href="#fixing-findings-with-the-remediation-agent" id="fixing-findings-with-the-remediation-agent"></a>

Use the SonarQube Remediation Agent to propose fixes for Hunter Agent findings with an **Open**, **Confirmed**, or **Accepted** status, regardless of language. Your instance needs a separate Remediation Agent subscription in addition to its Hunter Agent subscription.

An instance administrator must deploy and enable the Remediation Agent, configure an LLM provider and model, and turn on **Manual backlog remediation**. Your project must be bound to GitHub, GitLab, or Azure DevOps, with write access for the agent. See [Backlog fix prerequisites](/sonarqube-server/user-guide/issues/with-ai-features/backlog-fix-suggestions.md#prerequisites).

To request a fix for one finding, select **Fix with agent** in its issue row or on its details page.

To request fixes for several findings:

1. Open your project's **Issues** page on the branch containing the findings.
2. Filter by the `hunter-agent` tag and select up to 20 eligible findings you want fixed.
3. Select **Fix \<count> with agent**.
4. Open **Project** > **Remediation Agent** in the project navigation to follow the jobs and review the linked pull requests.

Each finding starts a separate job and produces its own pull or merge request if a fix is available. See [Backlog fix suggestions](/sonarqube-server/user-guide/issues/with-ai-features/backlog-fix-suggestions.md#assigning-issues) for selection limits and how to review the results.

After you merge a fix, the finding closes when the next Hunter Agent analysis of that branch no longer detects it.

Hunter Agent findings use manual backlog remediation. Pull request remediation is not available for these findings.

## Related pages <a href="#related-pages" id="related-pages"></a>

* Instance admin: [Hunter Agent](/sonarqube-server/instance-administration/ai-features/hunter-agent.md)
* Project admin: [Hunter Agent](/sonarqube-server/project-administration/ai-features/hunter-agent.md)
* [Backlog fix suggestions](/sonarqube-server/user-guide/issues/with-ai-features/backlog-fix-suggestions.md)
* AC/DC: [Hunter Agent](/agent-centric-development-cycle/in-your-long-living-branches-the-code-maintenance-loop/hunter-agent.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.sonarsource.com/sonarqube-server/user-guide/issues/with-ai-features/hunter-agent-findings.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.