SonarQube Hunter Agent is now GA: Catch broken access control and business logic flaws

In 2026, a researcher was paid a $78,000 bug bounty for finding a flaw in Meta's systems: a logged-in user could pull another user's private support tickets and personal data just by changing an identifier in a request. Authentication worked exactly as designed. The system correctly confirmed who the user was—it just never checked whether that user was allowed to see that specific piece of data. SAST wouldn't have caught it, because there was no data flow/injection issue in the code. It ran exactly as written. 

This is one of many gaps SonarQube Hunter Agent is built to close, and as of today, it's generally available on SonarQube Cloud. SonarQube Server support is coming soon. 

Broken access control has been the OWASP Top 10's #1 web application risk since 2021, and it isn't shrinking: In OWASP's 2025 testing, every single application tested (100%) had some form of broken access control. Researchers found over 1.8 million individual instances of it, spread across 40 different types of access control flaws  more than any other risk category in the Top 10. It's also the category security tooling is least equipped to find, and the problem is compounding: AI coding agents now author more than 42% of committed enterprise code, generating access-control logic, permission checks, and business workflows faster than any human review process was built to handle.

Vulnerabilities that SAST tools miss

SonarQube's SAST engine is excellent at what it's designed to do: algorithmic and data-flow analysis that trace tainted input from an untrusted source to a sensitive sink. That's how it catches SQL injection, XSS, path traversal, hardcoded secrets, and hundreds of other vulnerability classes reliably, at scale, on every commit.

But there's a category of vulnerability that sits outside what any SAST can reach, not because of a tooling limitation, but because of the nature of the question itself. Does /invoices/8472 check that the requesting user actually owns invoice 8472, or does it just return whatever record matches the ID? Is a role check enforced only in the UI, and never revalidated server-side? Does completing step 3 of a checkout flow actually require having completed step 2? None of these are syntax problems. They're questions about intent,  about what a system is supposed to do, versus what it actually lets you do. And answering them requires reasoning about identity, roles, and workflow logic that a static analyzer has no mechanism to evaluate.

For years, the only way to close that gap was people: senior engineers doing manual code review, external pentest engagements once or twice a year, bug bounty programs, pre-release audits. That model is running out of runway. AppSec talent is scarce, pentests are point-in-time snapshots with long gaps between them, and release velocity, accelerated by AI-generated code has outpaced what manual review can keep up with. The cost of leaving that gap open isn't theoretical: broken access control alone exposed roughly 885 million records at First American, 64 million applicant records at McDonald's, and drained $9 million from Yearn Finance in a single exploit. These are not edge cases but real headlines.

How does Hunter Agent detect logic flaws?

Hunter Agent is an AI security agent, native to SonarQube, that reasons through your codebase the way a human security researcher works through a whitebox audit and confirms every finding before it ever reaches a developer.

It targets three classes of logic-level vulnerability that pattern-based scanning structurally cannot evaluate:

• Broken access control: IDOR, missing or incorrect authorization checks, privilege escalation, CSRF, sensitive data exposure
• Business logic flaws: skipped workflow steps, abuse of repeatable actions, missing rate limits
• Authentication & session management flaws: session fixation, non-expiring sessions, weak password recovery, missing MFA, brute-force gaps

Under the hood, Hunter Agent runs on the harness used by the SWE-bench-leading Sonar Foundation Agent. Rather than issuing a single prompt and taking whatever the model returns, it executes a structured, multi-phase pipeline:

1. Analyze: runs security playbooks in parallel across chunks of the codebase to surface candidate issues
2. Explore: maps the structure of the repository and splits it into manageable segments, which is how the agent scales to codebases beyond 10 million lines of code
3. Validate exploitability: a dedicated subagent takes each candidate finding and actively explores whether a feasible attack path exists, discarding anything it can't substantiate
4. Synthesize: consolidates validated findings into a single, reported result

From the outside, using it collapses to four steps with effectively zero setup: connect a SonarQube project (nothing to install), the playbook runs the analysis, the validation subagent confirms exploitability, and confirmed findings are raised as SonarQube issues—tagged, triaged, and gated exactly like any other finding your team already reviews. There's no separate portal and no new dashboard.

How reliable are  SonarQube Hunter Agent’s findings?

Any sufficiently capable LLM can be prompted to “look for security bugs” in a codebase. The problem is that raw model output on a task like this is neither precise nor stable. Point a generic prompt at the same codebase twice and you can get three findings on one run and 60 on the next. That is a variance that makes the output impossible to build a process around. A security team can't build a triage process around a tool that doesn't agree with itself.

That's the specific problem the exploitability-validation subagent is designed to solve: every candidate finding from the Analyze phase has to survive an independent attempt to demonstrate a feasible attack path before it's allowed to surface. In practice, that pushes average precision to 80–90%, high enough that a finding from Hunter Agent can be treated as a real, actionable signal rather than something to filter through another layer of manual investigation. In internal testing, it has surfaced more than 200 zero-day vulnerabilities across popular, well-audited open source projects.

How do I automatically detect broken access control in source code?

Hunter Agent is designed to add a reasoning layer without adding friction. It can run as a continuous background agent scheduled weekly or monthly against your main branch, or it can be triggered on demand. Findings surface asynchronously as SonarQube issues once they're confirmed, alongside the SAST and SCA findings your team already triages.

That's a deliberate design choice: surfacing both SAST issues and findings from Hunter Agent in the same workflow means you get full-spectrum coverage without forcing a tradeoff between depth and speed. It's language-agnostic across the 40+ programming languages SonarQube already supports, and incremental scanning cuts re-scan time on large repositories by roughly half.

Layered, not just independent

The agent that reviews your code is not the agent or model that wrote it. As more of your codebase is authored by AI coding assistants or agents themselves, a structurally independent verification layer matters: it's the difference between a system checking its own work and a second, differently purposed system checking whether the first one's output actually enforces the rules it was supposed to.

That independence is layered. SAST catches static code flaws, SCA catches vulnerable dependencies, and Hunter Agent adds a third lens, reasoning over code the way a security researcher would and catching logic and behavioral issues the others aren't built to see. Nothing is trusted by default to have caught everything alone, and that's Sonar’s zero-trust, multilayered approach to verification.

Hunter Agent's findings are also auditable: every finding carries the discovery path the agent followed, so a reviewer can see exactly how it got there.

Available today

SonarQube Hunter Agent is generally available now on SonarQube Cloud, for the Enterprise plan. Point it at any existing SonarQube project. There's nothing new to install, no new config needed. Support for SonarQube Server is coming soon.

Logic-level vulnerabilities don't announce themselves in a code review. They announce themselves in a breach report, or in someone else's bug bounty payout. Hunter Agent exists to make sure it's your team that finds them first.

Log in to SonarQube Cloud to get started, or reach out to your Sonar account team with questions.