open. This can happen when Antigen creates a new vulnerability or when verification finds that a previous remediation did not resolve the issue.
That status change fires a hook. Antigen has configured its built-in triage-agent to run on this hook. You can replace triage-agent with a custom agent, a Cursor Cloud agent, Devin, a Slack notification, or another workflow through the SDK.
What triage-agent does
triage-agent investigates the vulnerability through your connected integrations. It uses the evidence, your Asset Map, and any available code or infrastructure context to determine whether it has enough information and access to produce a remediation pull request or a proposed infrastructure change.
When it can proceed, triage-agent moves the vulnerability to in progress and assigns it to Antigen’s remediation-agent.
When triage is blocked
Iftriage-agent needs access to a specific integration before it can investigate, it records that it is blocked and asks your team to grant the required access. It can also create an issue in Linear, Jira, or another connected tool so the request reaches your team where it already works.
If triage-agent determines that the issue is too complex for remediation-agent, it leaves the vulnerability open. Your team can then assign it to a person or to one of your own agents.
The vulnerability remains a single live record throughout triage. Its status, assignment, evidence, and history stay available to every later workflow.