---
schema: "swft.publication/v1"
id: "company-capital-one-agents"
title: "Capital One: choosing the right checks for agent work"
description: "Capital One's Context Specs, VulnHunter, and DataAgents show how to evaluate parallel planning, security repair, and data-rule generation."
summary: "A useful agent pilot starts with a clear way to judge the result. Capital One offers three examples with different checks: plans need requirements review, repairs need evidence, and data rules need domain validation. Their published scale figures describe different things and should be compared separately."
canonical: "https://swft.io/companies/capital-one-agents"
author: "SWFT Editorial"
author_type: "Organization"
published: "2026-09-08"
modified: "2026-09-08"
kind: "case-study"
section: "Companies"
tags: ["Capital One", "Context Specs", "VulnHunter", "DataAgents", "multi-agent verification", "financial services"]
evidence_labels: ["INFERENCE", "OBS", "SELF-REPORT"]
source_ids: ["capital-one-context-specs", "capital-one-dataagents", "capital-one-vulnhunter", "capital-one-vulnhunter-repository"]
authorship_disclosure: "AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections."
---

# Capital One: choosing the right checks for agent work

Planning, security repair, and data analysis need different kinds of proof. Capital One's public engineering work makes those differences concrete.

> **Authorship:** AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections.

## Quick answer

A useful agent pilot starts with a clear way to judge the result. Capital One offers three examples with different checks: plans need requirements review, repairs need evidence, and data rules need domain validation. Their published scale figures describe different things and should be compared separately.

Capital One is putting agents to work on three different engineering problems. Context Specs organizes planning and implementation. VulnHunter finds and helps repair security defects. DataAgents produced rules for a large cloud-analysis project. Each workflow needs a different way to judge the result. The public record describes separate projects, not one bank-wide platform.

## Planning work that several agents can carry out

[Context Specs, released in June 2026](https://www.capitalone.com/tech/open-source/open-source-context-specs/), stores plans in files that later agent sessions can read. It divides a feature into ordered pieces, supplying the relevant code context for each. Three or more independent agents can review a specification in parallel. Implementation can also run in parallel when the plan's dependencies allow it, using separate Git worktrees: isolated working copies of the same repository.

Each piece declares a feedback signal, such as a test or endpoint check. That gives implementation a concrete stopping condition. Agreement among planning agents adds another perspective, but it does not establish that the specification matches the customer's need.

The count of three or more describes the documented review design. Capital One does not report the largest production run, its duration, or the number of concurrent implementation workers.

## Security findings must survive a challenge

Capital One's [VulnHunter announcement](https://www.capitalone.com/tech/open-source/announcing-vulnhunter/) reports internal use across thousands of repositories and tens of business areas before its July 2026 public release. The workflow investigates possible attack paths, tries to disprove its own findings, and proposes focused repairs for engineering review.

The [public repository](https://github.com/capitalone/vulnhunter) separates hunting, repair, and verification. A repair workflow creates a failing security test, makes a fix, and checks for regressions. A separate verifier assesses the result. Batch tooling lets the same process cover multiple repositories. SWFT inspected the documentation; it did not run a security evaluation of the tool.

Repository coverage is useful evidence of reach. It does not reveal how many scans ran together, how many issues people accepted, or how much review work remained. Those are separate questions for anyone comparing this system with another security workflow.

## Data rules need a domain expert

In [Capital One's DataAgents account](https://www.capitalone.com/tech/ai/data-agents/), an agent helped produce cloud-resource dormancy rules and Spark SQL queries for roughly 350 resource types. The author reports ten days of work against an initial estimate of six to nine months, including human validation.

Review caught wrong field names, nonexistent columns, and overconfident judgments. Some resources required usage telemetry rather than configuration alone. This is a useful limit: a query can run successfully while its business interpretation is wrong. The time comparison is a project estimate and result, not a controlled productivity study, and no agent concurrency is disclosed.

## Choose the proof before expanding the work

SWFT reads these as three distinct acceptance problems:

| Work | Evidence to inspect | Human question |
| --- | --- | --- |
| Feature planning | Requirements, dependencies, and review disagreements | Does this solve the intended problem? |
| Security repair | A reproducible defect, proposed change, and verification result | Is the repair sufficient and acceptable? |
| Detection rules | Executable queries plus checks against real domain behavior | Would this classification lead to the right action? |

For a first pilot, choose the row closest to an existing backlog. Agree on what counts as an accepted result, sample the difficult cases, and record the time spent reviewing and correcting them. Expand when that evidence supports it. A count of agents, repositories, or generated queries cannot answer those questions on its own.

## How we know

- **First-party report (SELF-REPORT)** Context Specs describes parallel specification review and dependency-aware implementation. Sources: [Context engineering: Introducing open-source Context Specs](https://www.capitalone.com/tech/open-source/open-source-context-specs/).
- **First-party report (SELF-REPORT)** Capital One reports internal VulnHunter use and a completed DataAgents project. Sources: [Announcing VulnHunter](https://www.capitalone.com/tech/open-source/announcing-vulnhunter/); [DataAgents: How we turned 9 months of analysis into 10 days](https://www.capitalone.com/tech/ai/data-agents/).
- **Observed artifact (OBS)** The public VulnHunter documentation exposes separate hunt, repair, and verification workflows. Sources: [VulnHunter](https://github.com/capitalone/vulnhunter).
- **Analysis (INFERENCE)** SWFT compares the acceptance decisions and metric boundaries across these independently documented workflows. Sources: [Context engineering: Introducing open-source Context Specs](https://www.capitalone.com/tech/open-source/open-source-context-specs/); [Announcing VulnHunter](https://www.capitalone.com/tech/open-source/announcing-vulnhunter/); [DataAgents: How we turned 9 months of analysis into 10 days](https://www.capitalone.com/tech/ai/data-agents/).

## Sources

- **First-party report (SELF-REPORT)** [Context engineering: Introducing open-source Context Specs](https://www.capitalone.com/tech/open-source/open-source-context-specs/) — Capital One; published 2026-06-24; accessed 2026-09-08. Describes the released planning, parallel validation, and implementation workflow; no production concurrency peak is reported.
- **First-party report (SELF-REPORT)** [DataAgents: How we turned 9 months of analysis into 10 days](https://www.capitalone.com/tech/ai/data-agents/) — Capital One; published 2026-06-09; accessed 2026-09-08. Completed rule-generation project; the six-to-nine-month comparator was an estimate.
- **First-party report (SELF-REPORT)** [Announcing VulnHunter](https://www.capitalone.com/tech/open-source/announcing-vulnhunter/) — Capital One; published 2026-07-16; accessed 2026-09-08. Reports internal security remediation across thousands of repositories before public release.
- **Observed artifact (OBS)** [VulnHunter](https://github.com/capitalone/vulnhunter) — Capital One / GitHub; accessed 2026-09-08. Public hunt, repair, and separate verification workflows; inspected documentation, not a SWFT execution test.

## Read next

- [Shopify River and Aquifer: a shared platform for agents across the company](/companies/shopify-river-aquifer)
- [Software factory metrics that matter](/software-factory-metrics)