Hunter Agent findings

View and work through the findings the SonarQube Hunter Agent raises on SonarQube Server 2026.5.

The SonarQube Hunter Agent runs a deep AI-powered analysis to find vulnerabilities that require human-like understanding of the code, such as broken access control and business-logic flaws, then raises them as issues you triage like any other.

The Hunter Agent is available in the Enterprise and Data Center editions and requires a separate subscription. An Instance Admin sets it up before you can use it. See Hunter Agent.

To learn what the agent detects and how it works, see Hunter Agent.

Viewing findings

Each project bound to a repository has a Hunter Agent page in its navigation. This page gives you a results overview: the count of open, confirmed, and accepted findings, and a breakdown by vulnerability category (broken access control, business logic, and authentication and session management).

Select the issues in one of the findings tiles on the Hunter Agent page to open the project's Issues page filtered to Hunter Agent findings. Each category count links to the issues for that category. On the Issues page, you can also filter by tag to see all agent findings or focus on one category:

• hunter-agent: all Hunter Agent findings
• hunter-broken-access-control: broken access control findings
• hunter-business-logic: business-logic findings
• hunter-auth-session: authentication and session management findings

Each finding is raised as a vulnerability with a security software quality and an estimated severity, and includes an explanation with Why is this an issue? and How to fix it? sections. Findings start as Open. Confirm a finding to mark it as a valid issue to fix, or Accept it to acknowledge it without fixing it right away. Open and confirmed findings may affect the quality gate; accepted findings do not. You review, assign, and comment on these findings like any other issue.

AI CodeFix is not available for Hunter Agent findings.

If your project has not run a Hunter Agent analysis yet, project administrators should read First analysis recommendations before the first run, so the first wave of findings does not fail the main branch's quality gate.

Related pages

• Instance admin: Hunter Agent
• Project admin: Hunter Agent
• AC/DC: Hunter Agent