Black Duck launches Signal Agentic Fix, an AI agent for automated vulnerability remediation
Application security vendor Black Duck has launched Signal Agentic Fix, an AI agent that automates the loop from vulnerability discovery to a validated fix. It is the latest addition to the Black Duck Signal collection of AI agents. Black Duck says the launch responds to a growing remediation backlog, driven by AI-generated code and new supply chain CVEs, and to attackers using AI to chain and weaponise vulnerabilities in hours while human-led remediation still takes days or weeks. This is vendor product news with no direct threat or incident.
Detalhes técnicos
- Scan: deterministic SAST and SCA engines, the same ones behind Polaris, Coverity and Black Duck SCA, find defects in proprietary code and open source dependencies.
- Triage: AI assesses severity, reachability and exploitability to filter false positives and prioritise the highest-risk issues.
- Fix: AI generates code fixes for SAST findings. SCA findings get dependency upgrade fixes based on Black Duck Security Advisories and the ContextAI knowledge base.
- Validate: fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests.
- Submit: every change goes to a human for review, either through the developer's AI coding agent (such as Claude Code) or as a pull request.
- It can run alongside a developer's coding agent or inside the DevOps pipeline, triggered on commits, builds or on demand.
Remediação
The article describes product controls rather than remediation for a specific threat: configurable remediation rules, customer-defined validation rules and mandatory human-in-the-loop approval before merge. Signal Agentic Fix for Claude Code is in Early Access. Further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA are due in the coming weeks.
Linha do tempo
-
Black Duck launches Signal Agentic Fix, an AI agent for automated vulnerability remediation
ler a análise desta fonte ocultar
Application security vendor Black Duck has launched Signal Agentic Fix, an AI agent that automates the loop from vulnerability discovery to a validated fix. It is the latest addition to the Black Duck Signal collection of AI agents. Black Duck says the launch responds to a growing remediation backlog, driven by AI-generated code and new supply chain CVEs, and to attackers using AI to chain and weaponise vulnerabilities in hours while human-led remediation still takes days or weeks. This is vendor product news with no direct threat or incident.
Technical Details
- Scan: deterministic SAST and SCA engines, the same ones behind Polaris, Coverity and Black Duck SCA, find defects in proprietary code and open source dependencies.
- Triage: AI assesses severity, reachability and exploitability to filter false positives and prioritise the highest-risk issues.
- Fix: AI generates code fixes for SAST findings. SCA findings get dependency upgrade fixes based on Black Duck Security Advisories and the ContextAI knowledge base.
- Validate: fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests.
- Submit: every change goes to a human for review, either through the developer's AI coding agent (such as Claude Code) or as a pull request.
- It can run alongside a developer's coding agent or inside the DevOps pipeline, triggered on commits, builds or on demand.
Remediation
The article describes product controls rather than remediation for a specific threat: configurable remediation rules, customer-defined validation rules and mandatory human-in-the-loop approval before merge. Signal Agentic Fix for Claude Code is in Early Access. Further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA are due in the coming weeks.