Summary
- Signal Agentic Fix combines static and dependency analysis with proposed remediation.
- Human review remains required before generated changes are merged.
- Claude Code integration is in early access, with further pipeline integrations planned.
Black Duck has introduced Signal Agentic Fix, a product intended to take software vulnerabilities from discovery through proposed remediation while leaving final acceptance of code changes with developers. The system combines static application security testing and software composition analysis with AI-assisted triage, generated fixes and subsequent rechecking. An integration for Claude Code is available in Early Access, while additional coding-agent and DevOps connections are planned.
The first part of the process uses existing analysis engines to identify defects in proprietary code and vulnerable third-party dependencies. Those two categories require different remediation methods. A flaw in a developer’s own application may need a change to how its code handles inputs or privileges, whereas an inherited library weakness may be resolved by selecting a supported dependency version and confirming that the upgrade does not break other components.
Black Duck says the AI layer assesses findings, including reachability and exploitability information, before proposing changes. It can generate edits for static-analysis issues and dependency upgrade proposals informed by its security advisory data. The system then re-runs analysis and can invoke customer-defined tests or compliance checks. Passing those checks provides evidence that a proposed fix meets selected criteria; it does not guarantee that every possible security or functional regression has been eliminated.
An automated code change can alter application behaviour even when it addresses a security defect, particularly in regulated software and critical systems where testing and approvals are mandatory. The announced workflow submits changes as a pull request or through a developer’s coding-agent environment for human review. The organisation can also define which types of remediation are permitted and what validation must run before a change is considered.
The Claude Code integration operates alongside a developer’s existing agent: it supplies analysis results and remediation guidance for that agent to implement, then checks the revised code. In the planned DevOps implementation, commits or builds will trigger the analysis and remediation process and open a proposed fix for review in source control. Black Duck is introducing those integrations in phases, beginning with Claude Code Early Access.
The workflow puts the decision to merge a fix at the end of a defined sequence: identify a weakness, assess reachability, generate a change, rescan the updated code and run selected tests. Development teams can apply their own remediation policies and compliance checks before accepting a pull request. With the current Claude Code integration, Black Duck is bringing that process into the developer’s coding environment, while retaining human review before changes enter the codebase.
