Black Duck announced Signal Agentic Fix on October 27, an AI agent that scans for vulnerabilities, writes the fix, re-checks it and sends the change to a person for approval before anything merges.
According to the company’s release, Signal Agentic Fix is the newest agent in Black Duck Signal. It pairs the company’s static analysis (SAST) and software composition analysis (SCA) engines with AI-driven triage, fix generation and validation. The loop runs in five steps: scan, triage, fix, validate and submit. Black Duck says triage assesses severity, reachability and exploitability, and that dependency fixes draw on guidance from its own security advisories.
The release describes two ways to run it. One works alongside a developer’s AI coding agent, such as Claude Code, which implements the fix while Signal re-scans the result. The other plugs into source control and CI workflows and opens a pull request for team review. Black Duck lists configurable remediation rules, configurable validation rules and human approval as the guardrails, and says no change reaches the codebase without developer or team sign-off.
The company positions the product against a growing vulnerability backlog and shrinking time to exploit, claims that come from its own release. The part buyers can test is the approval gate. An agent that proposes fixes moves the bottleneck from writing patches to reviewing them, so the first thing to measure in a pilot is reviewer time per pull request and how many generated fixes get rejected. Teams already watching secrets and dependency risk, as in GitHub’s push protection change, will recognize the pattern of automation that stops short of the merge button.
