Black Duck has launched Signal Agentic Fix, an AI agent designed to automate the vulnerability remediation loop from scanning and triage through fix generation, validation and pull-request submission.
The product combines Black Duck’s deterministic static application security testing and software composition analysis engines with AI-driven reasoning. It evaluates severity, reachability and exploitability, generates code or dependency fixes, then rescans the result to check that the change did not introduce new defects.
Human approval remains a required control. Fixes can be delivered through an AI coding agent or as pull requests in source control, but Black Duck says no change reaches the codebase without explicit developer or team sign-off. Organizations can also define remediation rules, coding standards, compliance checks and test suites that generated changes must satisfy.
“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Black Duck’s chief product and technology officer. He said deterministic analysis, validation, guardrails and approval gates are what make agentic remediation viable for enterprises.
Signal Agentic Fix for Claude Code is available in early access. Additional coding-agent and DevOps pipeline integrations for Polaris, Coverity and Black Duck SCA are planned in the coming weeks, according to the company.
The approach targets a real bottleneck: vulnerability discovery is accelerating faster than remediation capacity. The risk is that automated fixes can create subtle functional or security regressions. Teams should treat generated patches as evidence-backed proposals, require tests that reflect production behavior and measure whether the system actually reduces exploitable backlog rather than simply increasing patch volume.
