AI News Feed
Market watch
LG UltraFine Evo 32U990A-S Hits Record-Low $1,099 on Amazon, TechRadar ReportsNewegg Labor Day Deal: 32GB Kingston Fury Beast DDR4-3200 Kit Nearly Half Price at $179.99 with CodeGalaxy Z Fold 8 inner screen corners reported with excessive giveHuawei unveils Mate XT 2 tri-fold with privacy-screen edition as Apple prepares folding iPhoneWall Street Analysts Recommend Nvidia, Uber and Marvell for Long-Term GrowthLenovo, AMD and Huawei Put Local Large-Model AI at Center of New Devices
LG UltraFine Evo 32U990A-S Hits Record-Low $1,099 on Amazon, TechRadar ReportsNewegg Labor Day Deal: 32GB Kingston Fury Beast DDR4-3200 Kit Nearly Half Price at $179.99 with CodeGalaxy Z Fold 8 inner screen corners reported with excessive giveHuawei unveils Mate XT 2 tri-fold with privacy-screen edition as Apple prepares folding iPhoneWall Street Analysts Recommend Nvidia, Uber and Marvell for Long-Term GrowthLenovo, AMD and Huawei Put Local Large-Model AI at Center of New Devices
Products & Applications

SonarSource introduces SonarQube Hunter Agent for reasoning-based security verification

SonarSource today released SonarQube Hunter Agent, an AI agent that detects logic flaws and security gaps invisible to pattern-based code scanners. It is now generally available on SonarQube Cloud.

AI News Feed · 2026-08-28 01:58

The agent targets vulnerabilities where code behaves exactly as written but drifts from its intended purpose. For example, a user might open another customer's records, skip a checkout step, or leave a session alive past its expiry. Nothing in the source appears broken at the scanner level, so these issues have traditionally required manual review by security engineers or penetration testers.

Sonar said the shrinking gap between release and exploitation, accelerated by AI-assisted development, has made manual verification obsolete. The Hunter Agent works across an entire codebase, tracing how code, data, and user identity move through an application, then develops a theory about where the implementation diverged from its intended behavior. It investigates and confirms each candidate issue before reporting it to developers.

Confirmed findings appear directly in the SonarQube issue list, assigned and tracked like any other defect. The agent runs in the background on a team-defined schedule or can be triggered manually. Pull requests are never blocked, and continuous integration pipelines are not slowed.

Johannes Dahse, Sonar's vice president of code security, said AI is changing "not only the speed of software development, but also the scale of the verification challenge." He added that placing reasoning-based findings into the SonarQube workflow gives security and development teams a practical way to extend verification as AI-driven development accelerates.

Sonar positions Hunter Agent as an addition to SonarQube's existing static application security testing (SAST), not a replacement. SAST reads how code is written; Hunter Agent targets what the code was supposed to do. The agent uses playbooks – multistep security prompt sequences – that encode Sonar's application security expertise, and each finding includes the discovery path.

Hunter Agent is generally available today on SonarQube Cloud. An enterprise alpha ran earlier this year, and beta access opened July 9 for SonarQube Cloud Enterprise customers. Support for SonarQube Server is planned but no date has been given. The launch follows Sonar's release of Sonar Vortex and SonarQube Remediation Agent at the AI Engineer World's Fair in June.