The Good Tech Companies - SonarQube Hunter Agent is Now GA: Catch Broken Access Control and Business Logic Flaws

Episode Date: September 2, 2026

This story was originally published on HackerNoon at: https://hackernoon.com/sonarqube-hunter-agent-is-now-ga-catch-broken-access-control-and-business-logic-flaws. SonarQube Hunter Agent uses AI reasoning to find broken access control, business logic flaws, and security bugs traditional SAST tools miss. Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #cybersecurity, #authentication, #finance, #programming, #artificial-intelligence, #business, #sonarqube-hunter-agent, #good-company, and more. This story was written by: @sonarsource. Learn more about this writer by checking @sonarsource's about page, and for more stories, please visit hackernoon.com. SonarQube Hunter Agent uses AI reasoning to find broken access control, business logic flaws, and security bugs traditional SAST tools miss.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. Sonar Cube Hunter agent is now Gaw. Catch broken access control and business logic flaws by Sonar. In 2026, a researcher was paid a $78,000 bug bounty for finding a flaw in metasystems. Logged in user could pull another user's private support tickets and personal data just by changing an identifier in a request. Authentication worked exactly as designed. The system correctly confirmed who the user was. It just never checked whether that user was allowed to see that specific piece of data. SAST wouldn't have caught it because there was no data flow injection issue in the code. It ran exactly as written. This is one of many gaps SonarCube Hunter agent is built to close, and as of today, it's generally available on SonarCube cloud. SonarCube server support is coming soon. Broken Access Control has been the OWASP Top 10's number one web application

risk since 2021, and it isn't shrinking. In OWASP's 2025 testing, every single application tested, 100% had some form of broken access control. Researchers found over 1, 8 million individual instances of it spread across 40 different types of access control flaws more than any other risk category in the top 10. It's also the category security tooling is least equipped to find, and the problem is compounding. AI coding agents now author more than 42% of committed enterprise. code, generating access control logic, permission checks, and business workflows faster than any human review process was built to handle. Vulnerabilities that SAST tools miss. SonarCube's SAST engine is excellent at what it's designed to do. Algorithmy can data flow analysis that trace

tainted input from an untrusted source to a sensitive sink. That's how it catches SQL injection, XSS, Path Traversal, hard-coded secrets, and hundreds of other vulnerability classes reliably, at-scale, on every commit. But there's a category of vulnerability that sits outside what any SAST can reach, not because of a tooling limitation, but because of the nature of the question itself. Does Invoices 8,472 check that the requesting user actually owns Invoice 8,472, or does it just return whatever record matches the ID? Is a roll check enforced only in the UI? and never-revalidated server-side? Does completing step three of a checkout flow actually require having completed step two? None of these are syntax problems. They're questions about intent,

about what a system is supposed to do, versus what it actually lets you do. And answering them requires reasoning about identity, roles, and workflow logic that a static analyzer has no mechanism to evaluate. For years, the only way to close that gap was people, senior engineers doing manual code review, external pentest engagements once or twice a year, bug bounty programs, pre-release audits. That model is running out of runway. AppSecTalant is scarce. Pen tests are point and time snapshots with long gaps between them and release velocity, accelerated by AI generated code has outpaced what manual review can keep up with. The cost of leaving that gap open isn't theoretical. Broken access control alone exposed roughly 885 million records at First American,

64 million applicant records at McDonald's and drained $9 million from urine finance in a single exploit. These are not edge cases but real headlines. How does Hunter Agent detect logic flaws? Hunter Agent is an AI security agent, native to Sonar Cube, that reasons through your code base the way a human security researcher works through a white box auditant confirms every finding before it ever reaches a developer. It targets three classes of logic level vulnerability that pattern-based scanning structurally cannot evaluate. Broken access control. IDOR, missing or incorrect authorization checks, privilege escalation, CSRF, sensitive data exposure. Business logic flaws. Skip workflow steps, abuse of repeatable actions, missing rate limits. Authentication and

session management flaws. Session fixation, non-expiring sessions, weak password recovery, missing MFA, Brutforce gaps. Under the hood, Hunter agent runs on the harness used by the SWE bench leading Sonar Foundation agent. Rather than issuing a single prompt and taking whatever the model returns, it executes a structured, multi-phase pipeline. One, analyze, runs security playbooks in parallel across chunks of the code base to surface candidate issues. Two, explore, maps the structure of the repository and splits it into manageable segments, which is how the agent scales to codebases beyond 10 million lines of code. 3. Validate exploitability.

A dedicated subagent takes each candidate finding and actively explores whether a feasible attack path exists, discarding anything it can't substantiate. 4. Synthes consolidates validated findings into a single, reported result. From the outside, using it collapses to four steps with effectively zero setup. Connect a sonar cube project. Nothing to install. The playbook runs the analysis. the validation subagent confirms exploitability and confirmed findings are raised as SonarCube issues, tagged, triaged, and gated exactly like any other finding your team already reviews.

There's no separate portal and no new dashboard. How reliable are SonarCube Hunter agents' findings? Any sufficiently capable LLM can be prompted to look for security bugs in a codebase. The problem is that raw model output on a task like this is neither precise nor stable. point a generic prompt at the same codebase twice and you can get three findings on one run and 60 on the next. That is a variance that makes the output impossible to build a process around. A security team can't build a triage process around a tool that doesn't agree with itself. That's the specific problem the exploitability validation subagent is designed to solve. Every candidate finding from the analyze phase has to survive an independent attempt to demonstrate a feasible attack path before it's allowed to surface.

In practice, that pushes average precision to 80 to 90%, high enough that a finding from Hunter agent can be treated as a real, actionable signal rather than something to filter through another layer of manual investigation. In internal testing, it has surfaced more than 200-0-day vulnerabilities across popular, well-audited open-source projects. How do I automatically detect broken access control in source code? Hunter agent is designed to add a reasoning layer without adding friction. It can run as a background agent scheduled.

weekly or monthly against your main branch, or it can be triggered on demand. Findings surface asynchronously as Sonar Cube issues once they're confirmed, alongside the SAST and SCA findings your your team already triages. That's a deliberate design choice. Surfacing both SAST issues and findings from Hunter agent in the same workflow means you get full spectrum coverage without forcing a trade-off between depth and speed. Its language agnostic across the 40-plus programming languages SonarCube already supports, and incremental scanning cuts re-scan time on large repositories by roughly half. Layered, not just independent. The agent that reviews your code is not the agent or model that wrote it. As more of your codebase is authored by AI coding assistants or agents themselves,

a structurally independent verification layer matters. It's the difference between a system checking its own work and a second, differently purposed system checking whether the first one's output actually enforces the rules it was supposed to. That independence is layered. SAST catches static code flaws, SCA catches vulnerable dependencies, and Hunter agent adds a third lens, reasoning over code the way a security researcher would and catching logic and behavioral issues the others aren't built to see. Nothing is trusted by default to have caught everything alone, and that's Sonars Zero Trust, multi-layered approach to verification. Hunter agent's findings are also auditable. Every finding carries the discovery path the agent followed, so a reviewer can see exactly

how it got there. Available today, SonarCube Hunter Agent is generally available now on SonarCube Cloud for the enterprise plan. Pointed at any existing SonarCube project, there's nothing new to install, no new config needed. Support for SonarCube server is coming soon. Logic level vulnerabilities don't announce themselves in a code review. They announce themselves in a breach report or in someone else's bug bounty payout. Hunter agent exists to make sure it's your team that finds them first. Log in to SonarCube Cloud to get started or reach out to your Sonar account team with questions. Thank you for listening to this Hackernoon story, read by artificial intelligence. Visit hackernoon.com to read, write, learn and publish.