Reading room.

How to design a decision-grade pilot for agentic AI

Agentic AI changes the nature of a technology evaluation. When an AI system only generates an answer, a person reviews the output and decides whether to use it. An agent goes further: It gathers context, selects tools, m…

The Pentagon wants to know who checks code when AI writes it

The Department of War now treats AI-generated code as unverified until it’s proven otherwise. DoW Instruction 8430.01 , “Accelerated Mission Software,” took effect September 8, 2026, and is the department’s latest guidan…

10 questions to ask any software vendor about sovereignty

Sovereignty is moving from buzzword to buying criterion. The European Commission’s proposed Cloud and AI Development Act (CADA) would set assurance levels for the cloud and AI services public authorities buy, defining wh…

GitLab Orbit: Find vulnerability blast radius without the manual hunt

A critical vulnerability needs a fix and a map. The fix is usually fast. Finding where the vulnerable component lives, who owns it, and whether it s exposed to the Internet is what costs you time. Most security teams pie…

GitLab Orbit is GA: Higher agent accuracy, lower token cost

An agent’s true cost isn’t only the tokens it burns. It’s the review that calls your code “safe to merge” after seeing the diff, but without any context on the pipeline. We call that artificial confidence, not artificial…

What happens when vulnerabilities are discovered faster than you can fix them?

We re entering a new era of application security. Frontier AI models are uncovering complex flaws that traditional tools overlooked, and attackers are using the same models to exploit them faster. Remediation isn t keepi…

Extend GitLab Duo Agent Platform into your business systems

Developers mostly use GitLab Duo Agent Platform where they already work: the IDE, merge requests, and issues. But DevSecOps teams also support the business systems the rest of the company runs on, and those systems break…

Pillow CVE-2026-112900: How to find and fix it with GitLab

GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed in…

PHP2Shell: GitLab helps find and remediate critical PHP flaws

GitLab is not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The GitLab application is not written in PHP and does not run it to serve web requests, and our Security team has found no evidence of impact to…

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

AI Governance: One view of agent activity

AI coding agents are writing and changing code, from GitLab Duo Agent Platform agents to externally connected agents like Claude Code, Cursor, and Codex. You are accountable for what those agents do, yet most of their ac…

Uncover the business logic vulnerabilities SAST scanners miss

Broken object-level authorization ranks first on the OWASP API Security Top 10 , and OWASP says that traditional static application security testing (SAST) tools struggle to find access control flaws. A missing authoriza…

Redesign how your team ships software with AI agents

AI agents are sending more and more code into review queues built for human-paced work. A coding assistant can speed up code writing, but it can’t show you whether review, security checks, and release approvals can keep…

Building AI security in the open

When code becomes abundant trust becomes scarce. That is the argument GitLab CEO Bill Staples made in his recent essay : AI is collapsing the cost of producing software, and everything around production, including contex…

Three developer tasks worth handing to an agent

You already have an AI assistant. It completes your code, explains code you didn’t write, and maybe even drafts a whole feature while you sip your coffee. An agent on GitLab picks up where your editor stops. The AI in yo…

Unblock agentic software delivery with governed code review

AI agents have changed how much code a team can produce in a day. Review queues haven’t kept up, and delivery stalls while changes wait for a closer look. The usual workarounds (reminders, reviewer rotations, assigning a…

Connect your agents to your software lifecycle with the GitLab MCP server

Agents are working across your team s software development lifecycle, but most still operate as separate tools, leaving the context, handoffs, and permissions for your team to stitch together. When your agents use APIs f…

Get every merge request in front of the right reviewer, faster

The code is written. Now who reviews it? The volume of code has never been greater, but delivery hasn’t kept pace. At Meta, code changes on internal platforms grew 220% year over year, while changes that reached users as…

GitLab Secrets Manager: Govern secrets like your code

Credentials often start in an engineer s local dev environments, then get copied into unscoped CI/CD variables to keep pipelines running. Stored there as a raw value rather than a reference to a scoped secret, a signing…

GitLab 19.5 released

Gemini 4 Argon on GitLab: Built for long-running agentic work

As AI models take on longer, multi-step work, the challenge is putting that power to use across the software lifecycle without adding risk or cost. Teams need to be able to move faster, within enterprise controls and gua…

GitLab's agent orchestration eliminates the wait between development stages

AI coding tools have changed how fast software gets written, but not how fast it ships. As code generation accelerates, the bottleneck moves downstream into verify, review, and ship. Those stages still run on human time.…

Make every AI credit count: See, cap, and reduce agent spend

Costs multiply with every task you hand to an agent. Each task consumes tokens and credits, and as agents spread across your teams and automations, consumption can grow faster than usage. If you run the platform, you own…

Scaling Git for the agentic software factory

AI agents are fundamentally changing the economics of software development. As the cost of producing code falls, the volume of changes moving through the software factory is accelerating beyond what infrastructure design…

GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

Track organization-wide security risk in one dashboard

If you run application security across more than one top-level group, getting a single organization-wide view of your risk has meant manually pulling together data. That is operational work rebuilt in spreadsheets and on…

Every artifact your teams ship, assembled right the first time

Every software build is assembled from open source packages, base images, and libraries, with your code on top. When one of those components is missing or has drifted, the build fails. At agent speed, those failures mult…

Dependency Firewall: Block risky packages before the build

Attackers disguise malicious packages as ones you trust. In June 2026, GitLab researchers found five malicious PyPI packages , four of them typosquats of Flask, Requests, and NumPy, that run at install time and steal CI/…

GitLab Transcend: Speed you can trust, all the way to production

At Transcend, we made over a dozen announcements across all four layers of our architecture for agentic software engineering: agent orchestration, data and context, DevOps workflows, and governance and security. Watch th…

Two front doors: Module-level access in a Django GRC app

GitLab s engineering team builds a lot of our own internal tooling, but one platform in particular forced us to rethink how we handle authorization: our internal GRC tool that serves two very different customer bases und…

DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent

GitLab s Threat Research Group discovered a command execution vulnerability ( GHSA-grg2-7gc6-36m6 , CVE-2026-102437 ) in DeepSeek-Reasonix Studio, a desktop git client designed for developers pairing with AI coding assis…

GitLab and Claude Code: Fast, compliant AI

Government agencies are feeling twin pressures: While the U.S. Office of Management and Budget (OMB) is urging you to deploy AI faster, the U.S. Government Accountability Office (GAO) wants guardrails in place before tha…

What's new in Git 2.56.0?

The Git project recently released Git 2.56.0 . Let s look at some of the highlights of the release, including contributions from the Git team at GitLab. What s covered: Git Merge 2026 and schedule for Git 3.0 git-history…

GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7

How GitLab reduced code-per-agentic-flow ratio by 45%

GitLab Duo Agent Platform orchestrates and automates complex tasks through agentic flows. A key part of the platform is the Flow Registry, a declarative configuration framework, built from reusable components, that compi…

How to design GitLab for enterprise scale

At enterprise scale, even small architecture choices can have outsized consequences. A deployment that works for a handful of teams can become a constraint once thousands of developers, repositories, and pipelines depend…

Securing the software factory at machine speed

I joined GitLab at a moment when the way teams build and secure software has been changing rapidly. GitLab CEO Bill Staples recently framed that shift in When Code Is Abundant . When code is no longer the bottleneck, tru…

GitLab 19.4 released

GitLab Duo CLI takes a task from goal to done

Complex tasks hit a wall at the end of every chat turn. Developers already know what they re trying to accomplish. What stalls the work is the handoff back and forth between each step. Without a pre-defined definition of…

New MCP tools help platform teams scale automation

Agentic tools are moving fast past code completion into running pipelines, opening merge requests, and triaging work on a team s behalf. The Model Context Protocol ( MCP ) has become the common way these agents reach int…

See who spent your AI credits and set fair caps per team

Scaling AI across your organization depends on knowing where the budget is going and who’s using it. While a subscription cap keeps your total spend within budget, it can’t tell you how much AI was used by individual tea…

Optimize your team's price-performance with hosted open weight models

There’s no single best model for every software development task. Implementing a new feature, diagnosing a failed pipeline, and resolving security vulnerabilities all place different demands on the model handling them. G…

Rate limits on GitLab.com are changing

GitLab.com hosts millions of projects for teams of every size that need a platform they can rely on. Demand is climbing quickly, and we expect platform load to grow several times over this year. Predictable limits are wh…

When to use SAST versus an LLM security scanner

You re probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads…

GitLab Dedicated: Compliance for a new regulatory era

Enforcements such as NIS2 are no longer a future planning consideration. The European Union Agency for Cybersecurity s (ENISA) NIS360 report confirms that supervisory authorities are actively assessing cybersecurity matu…

How to calculate DevOps platform total cost of ownership

There’s nothing like budget pressure to put your DevOps platform under a microscope. But subscription fees and license costs only tell one part of the story. The total cost of ownership (TCO) for a DevOps platform also i…

GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8

Co-Create: Building GitLab with our users

GitLab users bring firsthand experience of the workflows they want to improve. Through our Co-Create program, they collaborate directly with us to design, build, and deliver product improvements that benefit more teams.…

Prepare for the Cyber Resilience Act's 24-hour reporting deadline

Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively ex…

Bring your own model to GitLab Duo Self-Hosted with Microsoft Foundry

For many organizations, the question about AI coding tools isn t whether they help, but where the code goes. Teams under data sovereignty, residency, or regulatory constraints need to know which network handles their sou…