Black Duck Signal Agentic Fix: AI patches, human sign-off

Attackers now use AI to find bugs faster. The defense is to fix them faster, and Black Duck wants an agent to do that. On October 27, it launched Signal Agentic Fix, an agent that scans your code, triages what it finds, writes the fix, re-scans it, and then waits for a human to approve it. That last step is the right call, and you should keep it.

What actually happened

Per Black Duck's announcement, Signal Agentic Fix runs five steps:

• Scan: deterministic static analysis (SAST) on your code and software composition analysis (SCA) on your open-source dependencies.
• Triage: AI ranks findings by severity, reachability and exploitability, and filters false positives.
• Fix: AI-written code changes for SAST findings; dependency upgrades for SCA findings.
• Validate: re-scan the fixed code, plus optional compliance checks and your own tests.
• Submit: send every change to a person for review.

It works two ways. In a coding agent such as Claude Code, it hands findings and fix guidance to the agent, the agent writes the fix, and Signal re-scans it. In a DevOps pipeline, it runs on commits, builds or on demand and opens a pull request. Teams set rules for what the agent is allowed or required to fix, at the project or organization level.

The Claude Code version is in Early Access now. Black Duck says integrations for other coding agents and pipelines across Polaris, Coverity and Black Duck SCA come "in the coming weeks." There is no public price, and the release gives no numbers on how fast or accurate the fixes are.

Why it matters for your business

A small team has a patch backlog, not a patch process. A scanner run can return hundreds of findings, and nobody has time to read them. Triage by reachability is the useful part: it tells you which vulnerable code your app actually calls.

Deterministic scan, AI fix, deterministic re-scan. That is the correct shape. The AI writes the patch, but a rule-based engine checks it before anyone sees it. Copy that pattern for any agent that changes code.

Pull requests are the approval gate you already have. Do not give any fix agent merge rights. A PR with a green re-scan and passing tests is a two-minute review, not a two-hour one.

Early Access means test it on one repo. Pick a repo with real tests. Without tests, "validated" only means "the scanner stopped complaining."

Sources: Black Duck, DEVOPSdigest.