# Capital One Tech The low down on our high tech from the engineering experts at Capital One. Learn about the solutions, ideas and stories driving our tech transformation. - Medium This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Advancing AI fluency at Capital One DevFeed: [Advancing AI fluency at Capital One]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-08-11T15:12:03Z Content type: opinion Language: en Sources: [Capital One Tech]() Topics: [Artificial Intelligence](), [AI Development](), [Development](), [cursor](), [Learning](), [Cloud]() Tags: [ai](), [ai-coding](), [ai-machine-learning](), [aifluency](), [cloud](), [developers](), [development](), [learning](), [software-development]() ### AI overview Capital One describes making AI fluency an enterprise-wide capability, including an AI learning hub for more than 60,000 associates and training for foundational literacy, advanced workflows, and specialized tools. The article also discusses AI coding tools and their role in helping engineers focus on architecture, complex systems thinking, and creative problem-solving. ### Source excerpt Capital One is raising the bar on AI fluency by making it a fundamental part of how we operate. At Capital One, we sought early on to operate like a bank that a technology company would build--modernizing our data ecosystem, going all in on the cloud and building an in-house engineering workforce. That deep investment has set us up to thrive with AI at enterprise scale today. As we continue to build at the forefront of technology and AI, sustaining an edge requires more than just deploying off-the-shelf models. Because at Capital One, we don't just use AI--we build AI. Delivering proprietary AI solutions across the enterprise requires investing deeply in the people who architect, customize and build with them. That's why our enterprise-wide emphasis on AI fluency isn't an ad-hoc training program. It is a fundamental part of how we operate, innovate and push the boundaries of what's possible for our business and our more than 100 million customers. AI skill building at enterprise scale Building on nearly a decade of insights from internal learning platforms and initiatives like Tech College--which offers hundreds of courses and offerings on topics like AI, machine learning, data, cloud engineering and beyond--this year we launched a dynamic, enterprise-wide AI learning hub to over 60,000 Capital One associates. More than a static content library, the platform meets associates where they are, whether that means building foundational AI literacy, mastering advanced workflows or getting training for specialized tools purpose-fit for their domains. We believe AI fluency shouldn't be treated as a side-of-desk exercise or an isolated science project; it must be a shared capability across the entire company. This is especially true for our engineers and developers. AI coding tools have redefined what high-performance software development looks like. By leveraging advanced AI capabilities to help streamline "run-the-engine" tasks, our engineers are more free to focus on complex ## Highlights from MLSys 2026 DevFeed: [Highlights from MLSys 2026]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-08-11T15:07:08Z Content type: opinion Language: en Sources: [Capital One Tech]() Topics: [Large Language Model](), [Retrieval Augmented Generation (RAG)](), [Machine learning](), [systems](), [Optimization](), [Deployment](), [Hardware](), [Streaming](), [Cache]() Tags: [2026](), [agentic](), [agentic-ai](), [ai-research](), [deployment](), [hardware](), [inference](), [large-language-model](), [machine-learning](), [optimization](), [research](), [retrieval-augmented-generation-rag](), [science]() ### AI overview Capital One's AI research team reviews themes and selected papers from MLSys 2026, focusing on efficient LLM serving, retrieval-augmented generation, cache management, model speculation, and agentic AI. The article highlights research on inference optimization, distributed compute and communication, streaming, and vector search. ### Source excerpt Capital One's AI research team recaps MLSys 2026, including optimizing serving LLMs, RAG and agentic AI. The 9th Annual Conference on Machine Learning and Systems (MLSys) took place in May in Bellevue, Washington. MLSys is a highly selective interdisciplinary conference sitting at the intersection of machine learning (ML) and systems design. The conference highlights cutting-edge research that combines generative AI, natural language processing, computer vision and reinforcement learning with infrastructure, deployment and hardware optimizations to make AI faster, scalable and more performant. MLSys offered Capital One associates the opportunity to learn from world-class conference sessions presented by experts in the field. All the attending associates left brimming with new ideas and planned collaborations. Kel Vanee, MVP, Machine Learning Engineering, presented some of the work happening at Capital One on using AI to make AI more efficient. Takeaways and favorite papers from MLSys 2026 Some of the most prevalent topics at MLSys this year were on cache management, model speculation, retrieval augmented generation (RAG) and agentic AI. With a plethora of relevant and interesting talks, we had no shortage of papers to choose favorites from. While a complete list of the papers we loved would be far too long, here are a few standouts: Large language model inference optimization One of the leading themes this year was how to more efficiently serve LLM models. We especially liked the papers on reducing self-attention costs, such as MAC-Attention: a Match-Amend-Complete scheme for fast and accurate attention computation and BLASST: Dynamic BLocked Attention Sparsity via Softmax Thresholding. We found valuable insights in papers covering how best to overlap computation with communication, such as TokenWeave: Efficient Compute-Communication Overlap for Distributed LLM Inference, Stream2LLM: Overlap Context Streaming and Prefill for Reduced Time-to-First-Token and FlashAgen ## Introducing AI-powered container standardization DevFeed: [Introducing AI-powered container standardization]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-27T15:04:11Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Containers](), [Vulnerabilities](), [Security](), [Artificial Intelligence](), [supply-chain-security](), [sdlc]() Tags: [ai](), [ai-security](), [cloud-native](), [containers](), [requirements](), [security](), [software-development](), [software-engineering](), [software-supply-chain](), [vulnerabilities]() ### AI overview The article presents AI-powered container standardization as an approach to automate vulnerability detection, prioritization, remediation, testing, and patch deployment. It recommends avoiding exposure through curated base images and vetted dependencies, then automating ongoing remediation within the software development life cycle. ### Source excerpt AI-powered container standardization enables hands-free security remediation without sacrificing development velocity. In today's cloud-native world, containers have become the foundation of modern software delivery. Managing container security at scale can present significant challenges, thousands of vulnerabilities to track, manual remediation processes, inconsistent base images across teams and compliance requirements that slow everything down. AI-powered container standardization is a comprehensive approach that leverages artificial intelligence (AI) to automate vulnerability detection, prioritization and remediation across your entire container ecosystem. This transformative solution significantly reduces the manual toil traditionally associated with keeping containers secure and compliant. Development teams can focus on building features while the system automatically identifies vulnerabilities, generates fixes, tests changes and deploys patches, minimizing human intervention for routine updates. This approach simplifies the coordination of vulnerability remediation across hundreds of teams while ensuring that security and compliance are embedded throughout the software life cycle. Organizations can empower their developers to focus on innovation rather than patching, resulting in faster releases, stronger security and more productive engineering teams. The strategic framework: avoid and automate Our strategy for managing vulnerabilities focuses on two core principles: avoiding exposure and automating remediation, with governance baked into the software development life cycle. Avoid: Secure the foundation to minimize risk entering your environment. The most effective vulnerability remediation happens prior to the vulnerability reaching your digital ecosystems. By controlling what enters the software supply chain through curated base images and vetted dependencies/packages, you dramatically reduce the attack surface before code ever runs in production. This inc ## Announcing Capital One's 2026 UIUC AI Awardees DevFeed: [Announcing Capital One's 2026 UIUC AI Awardees]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-21T14:45:44Z Content type: release Language: en Sources: [Capital One Tech]() Topics: [Artificial Intelligence](), [ai safety](), [Generative AI](), [Large Language Model](), [Code generation](), [Cybersecurity]() Tags: [2026](), [academic-research](), [agentic-ai](), [agents](), [ai](), [ai-research](), [ai-safety](), [code-generation](), [cybersecurity](), [generative-ai](), [large-language-models-llms](), [research](), [science]() ### AI overview Capital One announces its 2026-2027 research and fellowship awardees from the University of Illinois. The featured projects address LLM reasoning faithfulness, code reasoning, imaginative LLM agents, and agentic AI safety. ### Source excerpt Meet the University of Illinois researchers and fellows advancing Agentic AI through our academic partnership.Announcing the Center for Generative AI Safety, Knowledge Systems, and Cybersecurity (ASKS) 2026-2027 Capital One Research Awardees from the University of Illinois As we look toward the 2026-2027 academic year, we continue to partner with institutions that lead the global conversation on the future of intelligence. We are thrilled to announce this year's cohort of research and fellowship awardees from the University of Illinois, whose pioneering work addresses the most critical frontier in technology today: Agentic AI. From the way machines "think" and "imagine" to the hardware that powers them and the safety protocols that govern them, these five projects represent Capital One's holistic push toward AI that is not only powerful but also faithful, safe and creative. The 2026-2027 research awardees1. Ensuring Intellectual Honesty Advancing LLM Reasoning Faithfulness without Faithfulness Rewards Faculty: Hao Peng Professor Peng is tackling the "hallucination" problem at its core. By developing methods to ensure large language models (LLMs) follow a logical, faithful reasoning path-without relying on traditional, often biased, reward systems-this work ensures that when an AI gives an answer, the "why" behind it is actually true, a critical component for trustworthy financial applications. TrACE-Contrast: Faithful & Consistent Code Reasoning via Trace-Aware Contrastive Learning Faculty: Talia Ringer and Reyhan Jabaarvand Writing code is one thing; understanding how it executes is another. Professor Ringer's project uses contrastive learning to align a model's code generation with its actual execution "trace." This ensures that AI-generated software is verified and logically sound, which is vital for maintaining the integrity of our core technology systems. 2. Bridging the Gap: Agency & Imagination Creative LLM Agents based on Thinking with Imagination Faculty: H ## Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool DevFeed: [Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-17T17:01:41Z Content type: release Language: en Sources: [Capital One Tech]() Topics: [open-source-security](), [code security](), [Artificial Intelligence](), [Open Source](), [Vulnerabilities](), [Tooling](), [Developer experience]() Tags: [agentic-ai-security](), [ai-code-security](), [ai-security](), [build](), [claude-code](), [code-vulnerability](), [developer](), [developer-experience](), [developers](), [exploit](), [generative-ai-tools](), [open-source](), [vulnerabilities]() ### AI overview Capital One announces the open-source release of VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective. It is designed to identify potentially exploitable defects, map prospective attack paths, and propose targeted code remediations. ### Source excerpt Capital One's open-source, agentic AI code security tool. The rules of software security are changing faster than most defenders can keep pace. Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software. What once required significant skill and time can now be automated, accelerated, and scaled. The world faces an increasingly short window of time before highly sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary. Across the industry, organizations are racing to prepare for this paradigm shift. Traditional environmental protections like network segmentation, identity controls, and monitoring remain essential, but are no longer sufficient on their own. The ultimate defense in this new reality requires a shift in approach: organizations need to consider and detect the vulnerabilities in their code and fix them before adversaries can deploy advanced models to discover and exploit them. At Capital One, we decided that the right response to AI-enabled threats wasn't to wait, but to build cutting-edge AI-driven defenses and put them in the hands of defenders everywhere. That's why we are announcing today the open-source release of VulnHunter, an advanced agentic AI security tool designed to apply proactive, attacker-perspective analysis directly to the source code. Developed internally at Capital One, VulnHunter is not a traditional, passive vulnerability scanner. It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations. Built for the developer experience To fully unlock the utility of VulnHunter, we knew ease of use mattered. A persistent challenge with traditional security tools is that they are often built primarily to enforce rigid cybersecurity practices, without much consideration for a developer's ac ## Optimizing OPA performance: From arrays to objects DevFeed: [Optimizing OPA performance: From arrays to objects]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-07T14:25:30Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [opa](), [Open Policy Agent](), [rego](), [Data structures](), [Optimization](), [Algorithms, Complexity]() Tags: [algorithms](), [cloud-native](), [data-structures](), [kubernetes](), [opa](), [open-policy-agent](), [optimization](), [performance-tuning](), [rego](), [software-development](), [software-engineering](), [software-supply-chain]() ### AI overview This article explains how to improve Open Policy Agent performance by choosing appropriate data structures for Rego policies. It focuses on replacing nested arrays with keyed objects to avoid inefficient array traversal when evaluating large datasets. ### Source excerpt Achieve 99% faster Rego policy execution through optimization. Note: This post focuses on one aspect of performance tuning Rego policies and datasets evaluated by OPA-arrays vs. objects. The Rego Style Guide and Regal Rego linter are very helpful resources for learning Rego best practices and avoiding code smells in Rego policies. There is also the OPA performance tuning documentation. In 2018, I started using open policy agent (OPA) as a solution for controlling and preventing unwanted behaviors in our Kubernetes Clusters. OPA, along with Kubernetes Dynamic Admission Control, provided a means to build preventive controls. Since then, I have worked with several PaC solutions. I have always stayed close to the OPA tool set because of how well it supports multiple use cases. OPA is domain agnostic and can be used with virtually any use case, as long as you supply the correct data and policies. To that end, OPA use cases have expanded throughout several technical disciplines, such as cloud-native computing and software supply chain management. OPA performance engineering OPA enables us to unify PaC solutions across multiple use cases and systems, using the same languages and tools. However, there is always room for improvement and performance engineering policies and the execution thereof. In addition, optimizing data that policies evaluate and mutate should be part of our focus when we deliver OPA-based solutions. Recently I was asked to help with OPA performance issues. I made several recommendations, but I overlooked one simple and glaring issue: the poor performing policy was processing a large data set using nested-arrays, instead of the best practice of using keyed-objects. Later, something was bothering me about my interaction and I realized that while I gave decent architectural level advice, I completely missed the best engineering advice. Rego policies and data should be optimized just like other algorithms and relative data, and part of that optimization is ## LLM reasoning and agentic safety at ICML 2026 DevFeed: [LLM reasoning and agentic safety at ICML 2026]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-02T14:14:40Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Large Language Model](), [Fine-tuning](), [Trustworthy AI](), [Artificial Intelligence]() Tags: [2026](), [ai](), [ai-research](), [fine-tuning](), [icml](), [icml-2026](), [llm](), [llm-reasoning](), [reasoning](), [research](), [safety](), [science](), [trustworthy-ai]() ### AI overview Capital One presents research for ICML 2026 on critique-guided distillation for robust LLM reasoning and on safety risks in multi-turn tool-using agents. The article says its Critique-Guided Distillation framework trains models to refine flawed responses using teacher critiques, and reports higher mathematical-reasoning benchmark performance than critique fine-tuning and standard distillation, including a 7% average improvement and gains of up to 15.0% on AMC23 and 12.2% on MATH-500. ### Source excerpt Explore our latest research in critique-guided distillation and multi-turn agent uncertainty in Seoul.Explore our latest research in critique-guided distillation and multi-turn agent uncertainty in Seoul. Capital One technologists are excited to participate in the 43rd International Conference on Machine Learning (ICML) taking place at the COEX Convention & Exhibition Center in Seoul, South Korea, July 6-11, 2026. As a premier global venue for machine learning research, ICML provides an essential forum for exploring foundational advancements, algorithmic innovations and cutting-edge deep learning systems. Capital One is excited to share advancements in large language model (LLM) scaling efficiencies, multi-turn tool-using agent safety and the development of robust, trustworthy AI frameworks. This work delivers the underlying engineering and algorithmic improvements crucial for deploying the next generation of safe financial technologies. Main conference research: Robust reasoning and agentic risk The following research, accepted to the ICML Main Conference, pushes the boundaries of how models self-correct, how trajectory-level risks can be proactively flagged, and how multi-turn agent interactions maintain reliable execution. This section features work led by Capital One researchers alongside deep collaborations with academic partners. Critique-Guided Distillation for Robust Reasoning via Refinement Capital One Authors: Berkcan Kapusuzoglu, Supriyo Chakraborty, Michael Lee, Sambit Sahu Supervised fine-tuning with expert demonstrations often produces models that imitate outputs without internalizing the reasoning processes needed for robust generalization. While critique-based approaches show promise, training models to generate critiques directly, such as Critique Fine-Tuning (CFT), can lead to output-format drift and degradation of general capabilities. We propose Critique-Guided Distillation (CGD), a training framework that decouples critique consumption from crit ## Capital One at ACL 2026 DevFeed: [Capital One at ACL 2026]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-01T15:28:51Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Natural language processing](), [Large Language Model](), [LLM security](), [Machine Learning, Security Attacks](), [Reinforcement learning](), [Jailbreak](), [Security](), [Routing (disambiguation)](), [datasets]() Tags: [2026](), [ai](), [ai-ml](), [ai-research](), [conference](), [jailbreak](), [llm-security](), [natural-language-processing](), [paper](), [partners](), [red-teaming](), [reinforcement-learning](), [research](), [science]() ### AI overview Capital One describes its accepted ACL 2026 research on natural language processing, including work on adaptive LLM red teaming, query-only model routing with generated data, and language identification on web data. The article also highlights collaboration with academic partners. ### Source excerpt Discover how Capital One is advancing state-of-the-art AI/ML science through collaborative natural language processing research.Advancing AI and NLP Frontiers at ACL 2026 As language models grow more deeply integrated into technology ecosystems, pioneering robust, efficient, and reliable Natural Language Processing (NLP) techniques becomes paramount. Capital One continues to invest in state-of-the-art AI/ML science through deep multi-sector collaboration and peer-reviewed research. At the upcoming Annual Meeting of the Association for Computational Linguistics (ACL 2026), Capital One researchers and academic partners will showcase novel findings stretching from LLM security to multilingual capabilities. Through the Science & Academic Partnerships program, Capital One bridges industry needs with academic expertise, funding critical university research and engineering solutions that make technology safer and more powerful. Our accepted publications at ACL 2026 demonstrate this thriving flywheel of talent and collaborative innovation across multiple research categories. Main Conference Research Adaptive Instruction Composition for Automated LLM Red Teaming Routing with Generated Data: Annotation-Free LLM Skill Estimation and Expert Selection Capital One Authors: Jesse Zymet, Swapnil Shinde, Sahil Wadhwa, Andy Luo Overview: Standard red teaming approaches often struggle with a limited range of jailbreak strategies or rely on ineffective, randomized crowd-sourced tactics. This paper introduces a novel framework -- Adaptive Instruction Composition -- that utilizes reinforcement learning and a neural contextual bandit to tailor attack compositions dynamically, balancing diversity and effectiveness to proactively uncover target model vulnerabilities. Routing with Generated Data: Annotation-Free LLM Skill Estimation and Expert Selection Capital One Authors: Genta Winata, Sambit Sahu, Supriyo Chakraborty, Shixiong Zhang Overview: Emerging from our gifted research collaboration ## New Open-Source Context Specs Released DevFeed: [New Open-Source Context Specs Released]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-06-24T16:58:13Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Spec Driven Development](), [AI-assisted coding](), [context window](), [Open Source](), [Development]() Tags: [ai-assisted-coding](), [context-engineering](), [context-window](), [development](), [open-source](), [software-engineering](), [spec-driven-development]() ### AI overview Capital One has open-sourced Context Specs, a spec-driven development framework that uses context engineering for AI-assisted coding. It captures domain knowledge in reusable experts and uses automated feedback signals to verify an agent's work, addressing context-window constraints such as context decay, pollution, and compaction loss. ### Source excerpt Capital One open-sources Context Specs, an SDD framework using context engineering to bridge business ideas and code. Every developer has had the same experience: The AI writes code confidently, only for you to realize that it has missed the mark. The fix isn't a better model, it's better context. Right context, right time. That's the whole game. To address this challenge, Capital One is open-sourcing Context Specs, a framework for spec-driven development (SDD) that treats context engineering-the practice of building systems that dynamically decide what your agent sees and when it sees it-as the primary lever for AI-assisted coding. The framework achieves this by capturing a team's domain-specific knowledge into reusable "experts" that you create once and compose across the entire workflow, and then using automated feedback "signals" to verify the agent's work. The real problem: Your agent's context window is finite Every AI coding agent operates within a context window, a fixed amount of information it can see at any given moment. This constraint creates three mechanical failure modes that plague every developer using AI tools today: Context decay: Older messages in a conversation get ignored, summarized or dropped entirely. That careful instruction you gave 20 messages ago? Gone. Context pollution: When an agent searches your codebase autonomously, it pulls in irrelevant files. Every irrelevant token displaces a useful one. Compaction loss: When the window fills up, the system summarizes history to make room. You don't control what gets dropped. These aren't edge cases; they're the default experience. Most frameworks for AI-assisted development weren't designed with these constraints in mind. Some frameworks generate thousands of lines of specification markdown before a single line of code is written, burning millions of tokens on ceremony. Other frameworks are so lightweight they leave everything to interpretation, forcing the agent to search blindly and pollute ## DataAgents: How we turned 9 months of analysis into 10 days DevFeed: [DataAgents: How we turned 9 months of analysis into 10 days]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-06-09T22:42:18Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [Cloud](), [AI Agent](), [Amazon Web Services](), [Azure](), [Google Cloud Platform (GCP)](), [data]() Tags: [agentic-ai](), [ai](), [aws](), [azure](), [cloud](), [cloud-platform](), [data-analysis](), [false-positives](), [gcp](), [least-privilege](), [security]() ### AI overview This engineering deep dive describes the DataAgents pattern for analyzing heterogeneous cloud resources at scale. It focuses on cloud resource dormancy detection across AWS, Azure, and Google Cloud Platform, using entity-specific criteria, confidence-based prioritization, and documented reasoning. The article reports reducing the analysis effort from an estimated 6-9 months to 10 days. ### Source excerpt An engineering deep dive into the pattern that changed how we approach large-scale classification problems. Every engineering team has that project sitting in the backlog. The one where someone says, "We really should analyze all of these," and the room goes quiet. Everyone knows what "all of these" means -- hundreds of entities, complex rules, no clear starting point. For us, it was cloud resource dormancy detection. We had around 350 distinct cloud resource types spread across AWS, Azure and Google Cloud Platform (GCP). Each type has different behavior patterns. An EC2 instance sitting idle looks nothing like a dormant Amazon S3 (S3) bucket or an unattached Elastic IP. Detecting dormancy required understanding what "active" means for each specific resource, then writing detection logic that wouldn't flood operations teams with false positives. Traditional estimate: 6-9 months of expert analysis. Actual time: 10 days. Here's how we did it, and more importantly, here's the reusable pattern behind it. The problem with large-scale analysis: Before we get to the solution, it's worth naming the pattern that makes these projects so painful. It shows up everywhere: Cloud resources - Which of our 350 resource types are dormant? Data governance - Which of our 800 tables have quality issues we should monitor? Security - Which of our access entitlements violate least-privilege principles? Compliance - Which of our 500 policy controls need remediation? In every case, the structure is similar -- a large catalog of heterogeneous entities, entity-specific rules that don't generalize, unknown priorities and a high cost for getting it wrong. The traditional approach is not just slow. It's structurally limited. You get coverage of the "obvious" cases, inconsistent logic across analysts, and tribal knowledge that evaporates when people leave. What you need is something that can assess each entity, apply consistent criteria, prioritize by confidence and document its reasoning. The DataA