[{"data":1,"prerenderedAt":1003},["ShallowReactive",2],{"/blog/ai-agent-sandbox":3,"navigation-en-us":216,"banner-en-us":644,"footer-en-us":654,"blog-post-authors-en-us-Daniel Abeles":899,"blog-related-posts-en-us-ai-agent-sandbox":914,"blog-promotions-en-us":940,"next-steps-en-us":993},{"id":4,"title":5,"authors":6,"body":8,"category":175,"date":176,"description":177,"extension":178,"externalUrl":179,"faq":180,"featured":201,"heroImage":202,"meta":203,"navigation":204,"path":205,"seo":206,"slug":208,"stem":209,"tags":210,"template":214,"updatedDate":179,"__hash__":215},"blogPosts/en-us/blog/ai-agent-sandbox.md","A sandbox is only as closed as what an AI agent can reach",[7],"Daniel Abeles",{"type":9,"value":10,"toc":166},"minimark",[11,15,18,28,33,36,39,42,46,49,63,72,75,78,81,85,92,95,99,102,137,141,144,147,154],[12,13,14],"p",{},"In July, OpenAI and Hugging Face responsibly disclosed an OpenAI model under internal evaluation escaped its sandbox, reached the open internet, and accessed Hugging Face’s internal production infrastructure. The agent took datasets, cluster details, and cloud keys during the intrusion.",[12,16,17],{},"The most critical part of the external phase of this incident was the first hour, when the agent escaped its sandbox by using a vulnerability within a package proxy on its sandbox’s allowlist to access the internet.",[12,19,20,21,27],{},"As more frontier model developers ",[22,23,26],"a",{"href":24,"rel":25},"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals",[],"disclose similar incidents",", the security industry needs to closely consider how agents impact reachability within test environments. You also do not have to run evaluation harnesses for this to be your problem. Any workload that executes code behind an egress list has the same structure: CI runners, hosted sandboxes, and network-reachable tool servers. Most of those allowlists were built to stop data leaving, but that is now not the only thing they need to stop.",[29,30,32],"h2",{"id":31},"why-allowlists-extend-reachability","Why allowlists extend reachability",[12,34,35],{},"When building an allowlist, you typically consider what a workload needs to contact and weigh each entry by what data could leave through it.",[12,37,38],{},"OpenAI’s agent revealed a blind spot for this typical process. The package proxy the agent accessed is a service: it authenticates callers, runs software with vulnerabilities, and talks to the public internet. While the sandbox could not reach the internet, the agent gained access to the package proxy, which did.",[12,40,41],{},"An allowlist hands your AI workload the reach of any destination it can take over.",[29,43,45],{"id":44},"how-openais-model-escaped","How OpenAI’s model escaped",[12,47,48],{},"To escape, OpenAI’s agent identified two zero-day vulnerabilities in the package proxy on its allowlist with a very large payoff.",[12,50,51,52,57,58,62],{},"The first flaw was a server-side request forgery flaw that let the agent ask the proxy to fetch arbitrary URLs on its behalf. In ",[22,53,56],{"href":54,"rel":55},"https://www.youtube.com/watch?v=87DyyMV0kCY&t=721s",[],"OpenAI's Black Hat presentation",", the model's reasoning at that moment reads \"",[59,60,61],"em",{},"excellent, we have arbitrary SSRF",".\" The sandbox borrowed the proxy’s internet connection.",[12,64,65,66,71],{},"The second flaw was a privilege escalation. ",[22,67,70],{"href":68,"rel":69},"https://nvd.nist.gov/vuln/detail/CVE-2026-65616",[],"CVE-2026-65616"," (CVSS 8.8) causes a package proxy's refresh-token endpoint to issue new tokens without validating token signatures. These tokens carry their scope as a claim rather than the server looking it up, so once the signature goes unverified the claim is whatever the caller says.",[12,73,74],{},"In this case, the caller was the agent, which extended the access of its read-scoped token within the sandbox by editing its claim to administrative. It then submitted the token for refresh to the package proxy which returned an administrator-scoped token. As a result, the agent could act with administrator permission instead of its original read-only permission.",[12,76,77],{},"The agents worked as a group to break out. Together, they explored the one service they could reach until they found a way to make it fetch on their behalf, then shared the method so other agents could use it too. One agent noted that external exploitation was outside the scope of its instructions, but continued anyway.",[12,79,80],{},"Hugging Face and OpenAI also put the proxy compromise inside roughly the first half hour of the sandbox test despite the elusive nature of the vulnerabilities. Remember, these were  zero-days, so the agent could not reference a CVE or advisory. The package proxy is also closed-source, and its code was never in the agent’s training set.",[29,82,84],{"id":83},"why-the-model-escaped","Why the model escaped",[12,86,87,88,91],{},"We now know why the agent went after the proxy. It was stuck on its evaluation task, and OpenAI's presentation shows the model reasoning \"",[59,89,90],{},"perhaps answer online","\" before looking for a way out. Frontier models are rewarded for solving tasks quickly, so a stuck model looks for shortcuts, and OpenAI normally closes that one by disabling internet access.",[12,93,94],{},"There are still open questions about the agent's behavior, including everything the agent did during its four-day intrusion and what it did once it gained access to the internet. What we do know is that this agent revealed, in practical terms, that we must make some new considerations as we build test environments for security-capable, autonomous AI.",[29,96,98],{"id":97},"how-to-reduce-risk-across-ai-test-environments","How to reduce risk across AI test environments",[12,100,101],{},"If you’re building sandboxes for AI agents, here are four ways to reduce your risk and limit reachability:",[103,104,105,113,119,125],"ol",{},[106,107,108,112],"li",{},[109,110,111],"strong",{},"Block the routes a build client never uses",". A build client only downloads files. It has no reason to call the proxy's admin API, its configuration routes, or its token-refresh route, which swaps an expiring token for a new one and is the route that was abused in this incident.",[106,114,115,118],{},[109,116,117],{},"Restrict what the proxy itself can reach",". The agent got out because the proxy could reach the whole internet, so anyone controlling the proxy could too. Limit the proxy’s outbound connections to the registries it actually serves.",[106,120,121,124],{},[109,122,123],{},"Monitor the proxy."," A proxy serving a build-fleet is monotonous, with short connections, small downloads, and requests that mostly succeed. Consider alerting on anything that doesn’t follow that pattern, such as connections that stay open, data moving outward in bulk, a run of requests for packages that are not there, and any call to an admin route.",[106,126,127,130,131,136],{},[109,128,129],{},"Treat untrusted workloads as internet-facing."," If an untrusted workload can reach an internal service, treat that service as internet-facing. Anything that compromises the workload can reach it too. We looked at the ",[22,132,135],{"href":133,"rel":134},"https://about.gitlab.com/blog/harden-pipeline-perimeter-for-ai-assisted-coding/",[],"same question for CI runners earlier"," this year, where the untrusted code runs in a pipeline rather than an agent sandbox.",[29,138,140],{"id":139},"cyber-capable-models-require-new-sandbox-considerations","Cyber-capable models require new sandbox considerations",[12,142,143],{},"A sandbox is a list of things the workload inside it can talk to, and everything on that list brings its own reach with it. When a workload is a build job that doesn’t matter, but it does when agents widen that list in ways allowlist designs never anticipated.",[12,145,146],{},"Beyond evaluation harnesses, agentic workloads are also moving into CI, production automation, and into tooling that interacts with internal services. Each of those has a list with similar properties and structure. As models get better at finding and chaining flaws, the reach on those lists extends what agents can impact.",[12,148,149,150,153],{},"OpenAI observes that these agents remain \"bounded by the privileges they can obtain and the systems they can communicate with,\" so existing controls still work.",[151,152],"br",{},"\nWhat must change is how carefully we draw those lists to minimize reachability.",[155,156,157],"blockquote",{},[12,158,159,160,165],{},"Find more articles from the Threat Research team on our ",[22,161,164],{"href":162,"rel":163},"https://about.gitlab.com/blog/categories/security-labs/",[],"Security Labs site",".",{"title":167,"searchDepth":168,"depth":168,"links":169},"",2,[170,171,172,173,174],{"id":31,"depth":168,"text":32},{"id":44,"depth":168,"text":45},{"id":83,"depth":168,"text":84},{"id":97,"depth":168,"text":98},{"id":139,"depth":168,"text":140},"security-labs","2026-08-12","Stuck in an evaluation with no way out, an AI agent escaped in an hour through the one service on its allowlist. Here's the gap that opened.","md",null,{"header":181,"description":167,"groups":182},"Frequently asked questions",[183],{"questions":184},[185,189,192,195,198],{"question":186,"answer":187,"config":188},"How did the agent reach the internet if its sandbox had none?","It asked the proxy to fetch it. A server-side request forgery flaw in the package proxy let the agent supply arbitrary URLs, so the proxy made the requests on its behalf. The sandbox borrowed the proxy's connectivity.",{"id":167},{"question":190,"answer":191},"Was escaping part of what the agent was asked to do?","No. The benchmark scored exploitation of bugs in software like browser engines and kernels. OpenAI's presentation shows the agent stuck on a task, reasoning that the answer might be online, then looking for a way to reach it.",{"question":193,"answer":194},"Did the agents work together?","Yes. One agent established a channel with other agents by uploading a note to a shared internal package manager. Discovered exploits were posted there, so a method found by one agent became available to the rest.",{"question":196,"answer":197},"Would a private network or VPC have stopped it?","Not by itself. The sandbox already had no internet route. The permitted destination sat inside the trusted network, which is what made reaching it useful. Segmentation helps when the reachable services are constrained too.",{"question":199,"answer":200},"We use a hosted sandbox provider. Whose problem is this?","Both. Providers own the isolation technology. You own the allowlist, the services on it, and what those services can reach. Ask what the default allowlist permits and what those destinations reach.",false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786468880/uxouffutvvwsbxzikhyc.png",{},true,"/en-us/blog/ai-agent-sandbox",{"config":207,"title":5,"description":177},{"noIndex":201},"ai-agent-sandbox","en-us/blog/ai-agent-sandbox",[211,212,213],"security","AI","security research","BlogPost","MFgN5FpnR_IaYetS57LDC8Ictvud6l2WovACqBDZ7nI",{"logo":217,"freeTrial":222,"sales":227,"login":232,"items":237,"search":564,"minimal":595,"duo":614,"switchNav":623,"pricingDeployment":634},{"config":218},{"href":219,"dataGaName":220,"dataGaLocation":221},"/","gitlab logo","header",{"text":223,"config":224},"Get free trial",{"href":225,"dataGaName":226,"dataGaLocation":221},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":228,"config":229},"Request a demo",{"href":230,"dataGaName":231,"dataGaLocation":221},"/sales/?contact-topic=request-demo","sales",{"text":233,"config":234},"Sign in",{"href":235,"dataGaName":236,"dataGaLocation":221},"https://gitlab.com/users/sign_in/","sign in",[238,267,367,372,486,542],{"text":239,"config":240,"menu":242},"Platform",{"dataNavLevelOne":241},"platform",{"type":243,"columns":244},"cards",[245,251,259],{"title":239,"description":246,"link":247},"The intelligent orchestration platform for DevSecOps",{"text":248,"config":249},"Explore our Platform",{"href":250,"dataGaName":241,"dataGaLocation":221},"/platform/",{"title":252,"description":253,"link":254},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":255,"config":256},"Meet GitLab Duo",{"href":257,"dataGaName":258,"dataGaLocation":221},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":260,"description":261,"link":262},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":263,"config":264},"Learn more",{"href":265,"dataGaName":266,"dataGaLocation":221},"/why-gitlab/","why gitlab",{"text":268,"left":204,"config":269,"menu":271},"Product",{"dataNavLevelOne":270},"solutions",{"type":272,"link":273,"columns":277,"feature":346},"lists",{"text":274,"config":275},"View all Solutions",{"href":276,"dataGaName":270,"dataGaLocation":221},"/solutions/",[278,302,325],{"title":279,"description":280,"link":281,"items":286},"Automation","CI/CD and automation to accelerate deployment",{"config":282},{"icon":283,"href":284,"dataGaName":285,"dataGaLocation":221},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[287,291,294,298],{"text":288,"config":289},"CI/CD",{"href":290,"dataGaLocation":221,"dataGaName":288},"/solutions/continuous-integration/",{"text":252,"config":292},{"href":257,"dataGaLocation":221,"dataGaName":293},"gitlab duo agent platform - product menu",{"text":295,"config":296},"Source Code Management",{"href":297,"dataGaLocation":221,"dataGaName":295},"/solutions/source-code-management/",{"text":299,"config":300},"Automated Software Delivery",{"href":284,"dataGaLocation":221,"dataGaName":301},"Automated software delivery",{"title":303,"description":304,"link":305,"items":310},"Security","Deliver code faster without compromising security",{"config":306},{"href":307,"dataGaName":308,"dataGaLocation":221,"icon":309},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[311,315,320],{"text":312,"config":313},"Application Security Testing",{"href":307,"dataGaName":314,"dataGaLocation":221},"Application security testing",{"text":316,"config":317},"Software Supply Chain Security",{"href":318,"dataGaLocation":221,"dataGaName":319},"/solutions/supply-chain/","Software supply chain security",{"text":321,"config":322},"Software Compliance",{"href":323,"dataGaName":324,"dataGaLocation":221},"/solutions/software-compliance/","software compliance",{"title":326,"link":327,"items":332},"Measurement",{"config":328},{"icon":329,"href":330,"dataGaName":331,"dataGaLocation":221},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[333,337,341],{"text":334,"config":335},"Visibility & Measurement",{"href":330,"dataGaLocation":221,"dataGaName":336},"Visibility and Measurement",{"text":338,"config":339},"Value Stream Management",{"href":340,"dataGaLocation":221,"dataGaName":338},"/solutions/value-stream-management/",{"text":342,"config":343},"Analytics & Insights",{"href":344,"dataGaLocation":221,"dataGaName":345},"/solutions/analytics-and-insights/","Analytics and insights",{"title":347,"type":272,"items":348},"GitLab for",[349,355,361],{"text":350,"config":351},"Enterprise",{"icon":352,"href":353,"dataGaLocation":221,"dataGaName":354},"Building","/enterprise/","enterprise",{"text":356,"config":357},"Small Business",{"icon":358,"href":359,"dataGaLocation":221,"dataGaName":360},"Work","/small-business/","small business",{"text":362,"config":363},"Public Sector",{"icon":364,"href":365,"dataGaLocation":221,"dataGaName":366},"Organization","/solutions/public-sector/","public sector",{"text":368,"config":369},"Pricing",{"href":370,"dataGaName":371,"dataGaLocation":221,"dataNavLevelOne":371},"/pricing/","pricing",{"text":373,"config":374,"menu":376},"Resources",{"dataNavLevelOne":375},"resources",{"type":272,"link":377,"columns":381,"feature":475},{"text":378,"config":379},"View all resources",{"href":380,"dataGaName":375,"dataGaLocation":221},"/resources/",[382,415,442],{"title":383,"items":384},"Getting started",[385,390,395,400,405,410],{"text":386,"config":387},"Install",{"href":388,"dataGaName":389,"dataGaLocation":221},"/install/","install",{"text":391,"config":392},"Quick start guides",{"href":393,"dataGaName":394,"dataGaLocation":221},"/get-started/","quick setup checklists",{"text":396,"config":397},"Learn",{"href":398,"dataGaLocation":221,"dataGaName":399},"https://university.gitlab.com/","learn",{"text":401,"config":402},"Product documentation",{"href":403,"dataGaName":404,"dataGaLocation":221},"https://docs.gitlab.com/","product documentation",{"text":406,"config":407},"Best practice videos",{"href":408,"dataGaName":409,"dataGaLocation":221},"/getting-started-videos/","best practice videos",{"text":411,"config":412},"Integrations",{"href":413,"dataGaName":414,"dataGaLocation":221},"/integrations/","integrations",{"title":416,"items":417},"Discover",[418,423,428,433,437],{"text":419,"config":420},"Customer success stories",{"href":421,"dataGaName":422,"dataGaLocation":221},"/customers/","customer success stories",{"text":424,"config":425},"Blog",{"href":426,"dataGaName":427,"dataGaLocation":221},"/blog/","blog",{"text":429,"config":430},"Demo Hub",{"href":431,"dataGaName":432,"dataGaLocation":221},"/demo-hub/","demo hub",{"text":434,"config":435},"The Source",{"href":436,"dataGaName":427,"dataGaLocation":221},"/the-source/",{"text":438,"config":439},"Remote",{"href":440,"dataGaName":441,"dataGaLocation":221},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":443,"items":444},"Connect",[445,450,455,460,465,470],{"text":446,"config":447},"GitLab Services",{"href":448,"dataGaName":449,"dataGaLocation":221},"/services/","services",{"text":451,"config":452},"Contribute",{"href":453,"dataGaName":454,"dataGaLocation":221},"https://contributors.gitlab.com","contribute",{"text":456,"config":457},"Community",{"href":458,"dataGaName":459,"dataGaLocation":221},"/community/","community",{"text":461,"config":462},"Forum",{"href":463,"dataGaName":464,"dataGaLocation":221},"https://forum.gitlab.com/","forum",{"text":466,"config":467},"Events",{"href":468,"dataGaName":469,"dataGaLocation":221},"/events/","events",{"text":471,"config":472},"Partners",{"href":473,"dataGaName":474,"dataGaLocation":221},"/partners/","partners",{"config":476,"title":479,"text":480,"link":481},{"background":477,"textColor":478},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":482,"config":483},"Read the latest",{"href":484,"dataGaName":485,"dataGaLocation":221},"/whats-new/","whats new",{"text":487,"config":488,"menu":490},"Company",{"dataNavLevelOne":489},"company",{"type":272,"columns":491},[492],{"items":493},[494,499,505,507,512,517,522,527,532,537],{"text":495,"config":496},"About",{"href":497,"dataGaName":498,"dataGaLocation":221},"/company/","about",{"text":500,"config":501,"footerGa":504},"Jobs",{"href":502,"dataGaName":503,"dataGaLocation":221},"/jobs/","jobs",{"dataGaName":503},{"text":466,"config":506},{"href":468,"dataGaName":469,"dataGaLocation":221},{"text":508,"config":509},"Leadership",{"href":510,"dataGaName":511,"dataGaLocation":221},"/company/team/e-group/","leadership",{"text":513,"config":514},"Handbook",{"href":515,"dataGaName":516,"dataGaLocation":221},"https://handbook.gitlab.com/","handbook",{"text":518,"config":519},"Investor relations",{"href":520,"dataGaName":521,"dataGaLocation":221},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":523,"config":524},"Trust Center",{"href":525,"dataGaName":526,"dataGaLocation":221},"/security/","trust center",{"text":528,"config":529},"AI Transparency Center",{"href":530,"dataGaName":531,"dataGaLocation":221},"/ai-transparency-center/","ai transparency center",{"text":533,"config":534},"Newsletter",{"href":535,"dataGaName":536,"dataGaLocation":221},"/company/contact/#contact-forms","newsletter",{"text":538,"config":539},"Press",{"href":540,"dataGaName":541,"dataGaLocation":221},"/press/","press",{"text":543,"config":544,"menu":545},"Contact us",{"dataNavLevelOne":489},{"type":272,"columns":546},[547],{"items":548},[549,554,559],{"text":550,"config":551},"Talk to sales",{"href":552,"dataGaName":553,"dataGaLocation":221},"/sales/","talk to sales",{"text":555,"config":556},"Support portal",{"href":557,"dataGaName":558,"dataGaLocation":221},"https://support.gitlab.com/hc/en-us","support portal",{"text":560,"config":561},"Customer portal",{"href":562,"dataGaName":563,"dataGaLocation":221},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":565,"login":566,"suggestions":573},"Close",{"text":567,"link":568},"To search repositories and projects, login to",{"text":569,"config":570},"gitlab.com",{"href":235,"dataGaName":571,"dataGaLocation":572},"search login","search",{"text":574,"default":575},"Suggestions",[576,578,582,584,588,592],{"text":252,"config":577},{"href":257,"dataGaName":252,"dataGaLocation":572},{"text":579,"config":580},"Code Suggestions (AI)",{"href":581,"dataGaName":579,"dataGaLocation":572},"/solutions/code-suggestions/",{"text":288,"config":583},{"href":290,"dataGaName":288,"dataGaLocation":572},{"text":585,"config":586},"GitLab on AWS",{"href":587,"dataGaName":585,"dataGaLocation":572},"/partners/technology-partners/aws/",{"text":589,"config":590},"GitLab on Google Cloud",{"href":591,"dataGaName":589,"dataGaLocation":572},"/partners/technology-partners/google-cloud-platform/",{"text":593,"config":594},"Why GitLab?",{"href":265,"dataGaName":593,"dataGaLocation":572},{"freeTrial":596,"mobileIcon":601,"desktopIcon":606,"secondaryButton":609},{"text":597,"config":598},"Start free trial",{"href":599,"dataGaName":226,"dataGaLocation":600},"https://gitlab.com/-/trials/new/","nav",{"altText":602,"config":603},"Gitlab Icon",{"src":604,"dataGaName":605,"dataGaLocation":600},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":602,"config":607},{"src":608,"dataGaName":605,"dataGaLocation":600},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":610,"config":611},"Get Started",{"href":612,"dataGaName":613,"dataGaLocation":600},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":615,"mobileIcon":619,"desktopIcon":621},{"text":616,"config":617},"Learn more about GitLab Duo",{"href":257,"dataGaName":618,"dataGaLocation":600},"gitlab duo",{"altText":602,"config":620},{"src":604,"dataGaName":605,"dataGaLocation":600},{"altText":602,"config":622},{"src":608,"dataGaName":605,"dataGaLocation":600},{"button":624,"mobileIcon":629,"desktopIcon":631},{"text":625,"config":626},"/switch",{"href":627,"dataGaName":628,"dataGaLocation":600},"#contact","switch",{"altText":602,"config":630},{"src":604,"dataGaName":605,"dataGaLocation":600},{"altText":602,"config":632},{"src":633,"dataGaName":605,"dataGaLocation":600},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":635,"mobileIcon":640,"desktopIcon":642},{"text":636,"config":637},"Back to pricing",{"href":370,"dataGaName":638,"dataGaLocation":600,"icon":639},"back to pricing","GoBack",{"altText":602,"config":641},{"src":604,"dataGaName":605,"dataGaLocation":600},{"altText":602,"config":643},{"src":608,"dataGaName":605,"dataGaLocation":600},{"title":645,"titleMobile":646,"button":647,"config":652},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":263,"config":648},{"href":649,"dataGaName":650,"dataGaLocation":651},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":653,"disabled":201},"release",{"data":655},{"text":656,"source":657,"edit":663,"contribute":668,"config":673,"items":678,"minimal":888},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":658,"config":659},"View page source",{"href":660,"dataGaName":661,"dataGaLocation":662},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":664,"config":665},"Edit this page",{"href":666,"dataGaName":667,"dataGaLocation":662},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":669,"config":670},"Please contribute",{"href":671,"dataGaName":672,"dataGaLocation":662},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":674,"facebook":675,"youtube":676,"linkedin":677},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[679,726,780,824,856],{"title":368,"links":680,"subMenu":695},[681,685,690],{"text":682,"config":683},"View plans",{"href":370,"dataGaName":684,"dataGaLocation":662},"view plans",{"text":686,"config":687},"Why Premium?",{"href":688,"dataGaName":689,"dataGaLocation":662},"/pricing/premium/","why premium",{"text":691,"config":692},"Why Ultimate?",{"href":693,"dataGaName":694,"dataGaLocation":662},"/pricing/ultimate/","why ultimate",[696],{"title":697,"links":698},"Contact Us",[699,702,704,706,711,716,721],{"text":700,"config":701},"Contact sales",{"href":552,"dataGaName":231,"dataGaLocation":662},{"text":555,"config":703},{"href":557,"dataGaName":558,"dataGaLocation":662},{"text":560,"config":705},{"href":562,"dataGaName":563,"dataGaLocation":662},{"text":707,"config":708},"Status",{"href":709,"dataGaName":710,"dataGaLocation":662},"https://status.gitlab.com/","status",{"text":712,"config":713},"Terms of use",{"href":714,"dataGaName":715,"dataGaLocation":662},"/terms/","terms of use",{"text":717,"config":718},"Privacy statement",{"href":719,"dataGaName":720,"dataGaLocation":662},"/privacy/","privacy statement",{"text":722,"config":723},"Cookie preferences",{"dataGaName":724,"dataGaLocation":662,"id":725,"isOneTrustButton":204},"cookie preferences","ot-sdk-btn",{"title":268,"links":727,"subMenu":736},[728,732],{"text":729,"config":730},"DevSecOps platform",{"href":250,"dataGaName":731,"dataGaLocation":662},"devsecops platform",{"text":733,"config":734},"AI-Assisted Development",{"href":257,"dataGaName":735,"dataGaLocation":662},"ai-assisted development",[737],{"title":738,"links":739},"Topics",[740,745,750,755,760,765,770,775],{"text":741,"config":742},"CICD",{"href":743,"dataGaName":744,"dataGaLocation":662},"/topics/ci-cd/","cicd",{"text":746,"config":747},"GitOps",{"href":748,"dataGaName":749,"dataGaLocation":662},"/topics/gitops/","gitops",{"text":751,"config":752},"DevOps",{"href":753,"dataGaName":754,"dataGaLocation":662},"/topics/devops/","devops",{"text":756,"config":757},"Version Control",{"href":758,"dataGaName":759,"dataGaLocation":662},"/topics/version-control/","version control",{"text":761,"config":762},"DevSecOps",{"href":763,"dataGaName":764,"dataGaLocation":662},"/topics/devsecops/","devsecops",{"text":766,"config":767},"Cloud Native",{"href":768,"dataGaName":769,"dataGaLocation":662},"/topics/cloud-native/","cloud native",{"text":771,"config":772},"AI for Coding",{"href":773,"dataGaName":774,"dataGaLocation":662},"/topics/devops/ai-for-coding/","ai for coding",{"text":776,"config":777},"Agentic AI",{"href":778,"dataGaName":779,"dataGaLocation":662},"/topics/agentic-ai/","agentic ai",{"title":781,"links":782},"Solutions",[783,785,787,792,796,799,803,806,808,811,814,819],{"text":312,"config":784},{"href":307,"dataGaName":312,"dataGaLocation":662},{"text":301,"config":786},{"href":284,"dataGaName":285,"dataGaLocation":662},{"text":788,"config":789},"Agile development",{"href":790,"dataGaName":791,"dataGaLocation":662},"/solutions/agile-delivery/","agile delivery",{"text":793,"config":794},"SCM",{"href":297,"dataGaName":795,"dataGaLocation":662},"source code management",{"text":741,"config":797},{"href":290,"dataGaName":798,"dataGaLocation":662},"continuous integration & delivery",{"text":800,"config":801},"Value stream management",{"href":340,"dataGaName":802,"dataGaLocation":662},"value stream management",{"text":746,"config":804},{"href":805,"dataGaName":749,"dataGaLocation":662},"/solutions/gitops/",{"text":350,"config":807},{"href":353,"dataGaName":354,"dataGaLocation":662},{"text":809,"config":810},"Small business",{"href":359,"dataGaName":360,"dataGaLocation":662},{"text":812,"config":813},"Public sector",{"href":365,"dataGaName":366,"dataGaLocation":662},{"text":815,"config":816},"Education",{"href":817,"dataGaName":818,"dataGaLocation":662},"/solutions/education/","education",{"text":820,"config":821},"Financial services",{"href":822,"dataGaName":823,"dataGaLocation":662},"/solutions/finance/","financial services",{"title":373,"links":825},[826,828,830,832,835,837,840,842,844,846,848,850,852,854],{"text":386,"config":827},{"href":388,"dataGaName":389,"dataGaLocation":662},{"text":391,"config":829},{"href":393,"dataGaName":394,"dataGaLocation":662},{"text":396,"config":831},{"href":398,"dataGaName":399,"dataGaLocation":662},{"text":401,"config":833},{"href":403,"dataGaName":834,"dataGaLocation":662},"docs",{"text":424,"config":836},{"href":426,"dataGaName":427,"dataGaLocation":662},{"text":838,"config":839},"What's new",{"href":484,"dataGaName":485,"dataGaLocation":662},{"text":419,"config":841},{"href":421,"dataGaName":422,"dataGaLocation":662},{"text":438,"config":843},{"href":440,"dataGaName":441,"dataGaLocation":662},{"text":446,"config":845},{"href":448,"dataGaName":449,"dataGaLocation":662},{"text":451,"config":847},{"href":453,"dataGaName":454,"dataGaLocation":662},{"text":456,"config":849},{"href":458,"dataGaName":459,"dataGaLocation":662},{"text":461,"config":851},{"href":463,"dataGaName":464,"dataGaLocation":662},{"text":466,"config":853},{"href":468,"dataGaName":469,"dataGaLocation":662},{"text":471,"config":855},{"href":473,"dataGaName":474,"dataGaLocation":662},{"title":487,"links":857},[858,860,862,864,866,868,872,877,879,881,883],{"text":495,"config":859},{"href":497,"dataGaName":489,"dataGaLocation":662},{"text":500,"config":861},{"href":502,"dataGaName":503,"dataGaLocation":662},{"text":508,"config":863},{"href":510,"dataGaName":511,"dataGaLocation":662},{"text":513,"config":865},{"href":515,"dataGaName":516,"dataGaLocation":662},{"text":518,"config":867},{"href":520,"dataGaName":521,"dataGaLocation":662},{"text":869,"config":870},"Sustainability",{"href":871,"dataGaName":869,"dataGaLocation":662},"/sustainability/",{"text":873,"config":874},"Diversity, inclusion and belonging (DIB)",{"href":875,"dataGaName":876,"dataGaLocation":662},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":523,"config":878},{"href":525,"dataGaName":526,"dataGaLocation":662},{"text":533,"config":880},{"href":535,"dataGaName":536,"dataGaLocation":662},{"text":538,"config":882},{"href":540,"dataGaName":541,"dataGaLocation":662},{"text":884,"config":885},"Modern Slavery Transparency Statement",{"href":886,"dataGaName":887,"dataGaLocation":662},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":889},[890,893,896],{"text":891,"config":892},"Terms",{"href":714,"dataGaName":715,"dataGaLocation":662},{"text":894,"config":895},"Cookies",{"dataGaName":724,"dataGaLocation":662,"id":725,"isOneTrustButton":204},{"text":897,"config":898},"Privacy",{"href":719,"dataGaName":720,"dataGaLocation":662},[900],{"id":901,"title":7,"body":179,"config":902,"content":905,"description":179,"extension":908,"meta":909,"navigation":204,"path":910,"seo":911,"stem":912,"__hash__":913},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":903,"gitlabHandle":904},"BlogAuthor","dabeles",{"name":7,"config":906},{"headshot":907},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg","yml",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",[915,923,932],{"title":916,"description":917,"heroImage":918,"category":175,"date":919,"authors":920,"slug":922,"externalUrl":179},"Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting","GitLab’s Vulnerability Research team has uncovered a new Python supply chain attack targeting PyPI, deploying the Shai-Hulud worm to steal credentials from CI/CD systems.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png","2026-06-09",[921,7],"Dinesh Bolkensteyn","shai-hulud-copycat-campaign-targets-python-developers",{"title":924,"description":925,"heroImage":926,"category":175,"date":927,"authors":928,"slug":931,"externalUrl":179},"How to detect and prevent Contagious Interview IDE attacks","Learn how we built custom controls that detect and prevent malware campaigns like those used for Contagious Interview and how to deploy them in your environment.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774375772/kpaaaiqhokevxxeoxvu0.png","2026-05-04",[929,930],"Josh Feehs","Austin Bollinger","how-to-detect-and-prevent-contagious-interview-ide-attacks",{"title":933,"description":934,"heroImage":935,"category":175,"date":936,"authors":937,"slug":939,"externalUrl":179},"Build an automated detection testing framework with GitLab CI/CD and Duo","Learn how GitLab's Signals Engineering team built the WATCH framework to continuously validate our security monitoring pipeline.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-04-30",[938],"Evan Baltman","automated-detection-testing-framework",{"promotions":941},[942,956,968,979],{"id":943,"categories":944,"header":946,"text":947,"button":948,"image":953},"ai-modernization",[945],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":949,"config":950},"Get your AI maturity score",{"href":951,"dataGaName":952,"dataGaLocation":427},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":954},{"src":955},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":957,"categories":958,"header":960,"text":947,"button":961,"image":965},"devops-modernization",[959,764],"product","Are you just managing tools or shipping innovation?",{"text":962,"config":963},"Get your DevOps maturity score",{"href":964,"dataGaName":952,"dataGaLocation":427},"/assessments/devops-modernization-assessment/",{"config":966},{"src":967},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":969,"categories":970,"header":971,"text":947,"button":972,"image":976},"security-modernization",[211],"Are you trading speed for security?",{"text":973,"config":974},"Get your security maturity score",{"href":975,"dataGaName":952,"dataGaLocation":427},"/assessments/security-modernization-assessment/",{"config":977},{"src":978},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":980,"paths":981,"header":984,"text":985,"button":986,"image":991},"github-azure-migration",[982,983],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":987,"config":988},"See how GitLab compares to GitHub",{"href":989,"dataGaName":990,"dataGaLocation":427},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":992},{"src":967},{"header":994,"blurb":995,"button":996,"secondaryButton":1001},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":997,"config":998},"Get your free trial",{"href":999,"dataGaName":226,"dataGaLocation":1000},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":700,"config":1002},{"href":552,"dataGaName":231,"dataGaLocation":1000},1786618878145]