Black Duck Launches Signal Agentic Fix for Automated Vulnerability Remediation

Black Duck released Signal Agentic Fix on October 27. The tool is an AI agent that scans for vulnerabilities, generates fixes, and validates them before a human approves any merged change.

Currently in early access as a Claude Code plug-in for Coverity users, Agentic Fix runs a five-step loop of scan, triage, fix, validate, and submit. The scanning phase uses the deterministic static analysis and software composition analysis engines from Polaris, Coverity, and Black Duck SCA, keeping findings consistent.

AI handles the later triage, fix, and validation steps. Triage assesses reachability, exploitability, and impact to filter false positives and prioritize riskiest issues. For proprietary code, the agent utilizes a configured LLM or AI coding agent to generate fixes, while open source dependencies receive component upgrades based on Black Duck Security Advisories. Validation re-scans the patched code, running customer-defined functional tests and compliance checks. If tests fail, the agent generates a new fix and validates it again.

Developers can approve individual fixes inside their IDE or coding agent session, or approve bulk fixes as pull requests in their source control system. The tool integrates with existing Polaris, Coverity, or Black Duck SCA instances to use their configuration and policy settings.

A second mode, Agentic Fix for DevOps Pipelines, handles bulk remediation in SCM and CI/CD systems, triggered by commits, builds, or on-demand requests. While the Claude Code integration is in early access, support for other coding agents and DevOps pipeline tools across Coverity, Polaris, and Black Duck SCA arrives in the coming weeks. Additionally, Black Duck's product page lists Signal AI Code Analysis for flaws like IDOR and BOLA as available now.