Security at machine speed. Control at every step.

Higher agent accuracy, lower token cost
Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.
Stay updated with our latest features and improvements.
Published on: October 28, 2026
Frontier AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention, inside the software factory.
We're entering a new era of application security. Frontier AI models are uncovering complex flaws that traditional tools overlooked, and attackers are using the same models to exploit them faster. Remediation isn't keeping pace: Verizon's 2026 Data Breach Investigations Report (DBIR) measures the median time to fully remediate a known-exploited vulnerability at 43 days, up from 32 in 2025.
Security teams are already stretched across growing application portfolios, third-party dependencies, and a steady stream of new disclosures. And while agents that find vulnerabilities and write fixes are becoming more accessible, integrating them into how enterprises actually build and ship software remains difficult.
A generated patch still needs to be tested. Security policies need to be enforced. Changes need to be reviewed and approved. And eventually, the fix needs to reach production safely.
This is where I believe the next major shift in application security will happen. We need to put autonomous agents to work inside the software factory. That's why we've brought Anthropic's Claude Mythos 5.1 into GitLab, and why we're connecting discovery, remediation, and prevention in one trusted workflow.
Critical vulnerabilities like PHP2Shell send security teams scrambling to understand exposure. For a large organization, that means assessing impact across hundreds or thousands of repositories, applications, and dependencies.
Identifying exposure is only the first step. Teams then need to assess exploitability, prioritize affected applications, coordinate fixes, run tests, and get changes into production. Every handoff takes time, and speed is vital: 31% of breaches now start with vulnerability exploitation, the top initial access vector for the first time in the DBIR's 19 years.
As more critical vulnerabilities emerge, the traditional model of manually investigating findings, assigning tickets, and waiting for developers to write fixes becomes harder to sustain.
The time between vulnerability discovery and verified remediation needs to shrink dramatically. That requires security workflows capable of operating at machine speed, while preserving the controls organizations depend on to ship reliable software.
AI agents can do impressive work in vulnerability discovery and remediation. The challenge is making that work reliable and repeatable across an enterprise.
An agent can generate a patch in seconds. Whether it understood the application, whether it validated the change against the real build, and whether it followed your security policies are separate questions. They get harder to answer, and more expensive to get wrong, as you deploy agents across thousands of projects.
At GitLab, we're bringing agentic security workflows into the environment where teams develop, test, and ship software.
Everything an agent does rests on how well it understands your system, and that understanding extends beyond the repository. GitLab Orbit, a live context graph of your software lifecycle, connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix. It's also how you answer the questions that follow a disclosure like PHP2Shell: Are we exposed? Is it reachable? How far does it spread, and how do we fix it without breaking production?
GitLab Duo Agent Platform investigates findings in the context of your software and how it's built, filtering out likely false positives and prioritizing by exploitability and reachability.
For the findings that matter, Duo writes a fix and puts it through your pipeline to check for regressions and rerun security scans. In a single merge request, developers review the change, Duo's explanation, and the pipeline results.
Security teams move from understanding exposure to initiating remediation in one pass, and developers shift from chasing findings to reviewing fixes. Because these workflows run inside the software factory, agents operate within the same processes and controls that organizations already use to deliver software.
That's how we turn agentic security from an isolated capability into something an enterprise can trust and operate across thousands of projects, at machine speed.
Some of the most dangerous application vulnerabilities require a deep understanding of how software is intended to work: missing authorization checks, broken ownership logic, and business logic flaws that expose customer data or let users take actions they shouldn't.
Traditional scanners struggle with these issues because finding them requires reasoning about the application's behavior and the relationships between components.
Our new Business Logic Security Analyzer, the first GitLab capability to support Anthropic's Claude Mythos 5.1, examines how your application enforces its rules: it reads the whole repository and incoming merge requests, infers what each endpoint should enforce, and flags the gaps that pattern-based scanners often miss.
But the real opportunity comes from connecting those discoveries to the workflows teams already use. When a critical flaw is found, teams need to understand its impact, initiate remediation, validate the proposed fix, and ship it safely. Integrating frontier AI into the software factory creates a path to run that entire process at machine speed.
The intelligence of the model is only as valuable as your ability to act on it.
Finding vulnerabilities earlier is valuable, and keeping vulnerable code and unsafe packages out of production altogether is even better. These protections become even more i