Artificial intelligence code verification and governance company SonarSource Sàrl today released SonarQube Hunter Agent, an AI agent built to find security flaws that pattern-based scanning cannot see.

The vulnerabilities it targets are the ones where the code does exactly what it was written to do. A user opens another customer’s records. A checkout step gets skipped. A session stays alive long after it should have expired.

Nothing in the source reads as broken, because at the level a scanner works, nothing is. Only someone who knows what the feature was meant to do can see the problem.

So the work has gone to people. A security engineer reads the code by hand, and when the budget stretches, a penetration tester goes at the running application from outside. Both cost money, both take time and both are out of date as soon as new code ships. Sonar said the shrinking gap between release and exploitation has made that a bigger problem than it used to be, with AI-assisted development pushing code out faster than any audit cycle can follow and logic flaws going unnoticed for months at a time.

Broken access control, business-logic flaws and weaknesses in authentication or session handling are the three things the agent looks for. Pattern matching finds none of them. Sonar has it work over a whole codebase, tracing where code, data and a user’s identity travel through an application.

Out of that comes a theory about where the implementation drifted from what the feature was meant to do, and the agent goes looking for proof. Every candidate issue is investigated and confirmed before a developer sees it.

No second tool is involved. Confirmed findings show up in the SonarQube issue list, in the same queue a team is already working through, and get assigned and tracked there like anything else. The agent runs in the background on whatever schedule a team sets. Scans can also be started by hand. Pull requests are never blocked and continuous integration pipelines are not slowed.

Johannes Dahse, Sonar’s vice president of code security, said AI is changing “not only the speed of software development, but also the scale of the verification challenge.” Putting reasoning-based findings into the SonarQube workflow gives security and development teams a practical way to extend verification as the pace of AI-driven development increases, he added.

Sonar is positioning the agent as an addition to SonarQube’s existing static application security testing rather than a replacement for it. SAST reads how code is written. Hunter Agent goes after what the code was supposed to do in the first place.

An enterprise alpha ran earlier this year and beta access opened on July 9 to SonarQube Cloud Enterprise customers. Under the hood the agent runs playbooks, multistep sequences of security prompts that encode the company’s own application security expertise. Findings arrive with the discovery path attached.

Agents have been the throughline of Sonar’s 2026. The company launched Sonar Vortex and the SonarQube Remediation Agent at the AI Engineer World’s Fair in June, the latter a background agent that writes fixes for existing issues and opens pull requests.

SonarQube Hunter Agent is generally available today on SonarQube Cloud. Support for SonarQube Server is planned, with no date given.

Image: Sonar