What happens when vulnerabilities are discovered faster than you can fix them?

We're entering a new era of application security. Frontier AI models are uncovering complex flaws that traditional tools overlooked, and attackers are using the same models to exploit them faster. Remediation isn't keeping pace: Verizon's 2026 Data Breach Investigations Report (DBIR) measures the median time to fully remediate a known-exploited vulnerability at 43 days, up from 32 in 2025.

Security teams are already stretched across growing application portfolios, third-party dependencies, and a steady stream of new disclosures. And while agents that find vulnerabilities and write fixes are becoming more accessible, integrating them into how enterprises actually build and ship software remains difficult.

A generated patch still needs to be tested. Security policies need to be enforced. Changes need to be reviewed and approved. And eventually, the fix needs to reach production safely.

This is where I believe the next major shift in application security will happen. We need to put autonomous agents to work inside the software factory. That's why we've brought Anthropic's Claude Mythos 5.1 into GitLab, and why we're connecting discovery, remediation, and prevention in one trusted workflow.

When critical vulnerabilities emerge, the clock starts ticking

Critical vulnerabilities like PHP2Shell send security teams scrambling to understand exposure. For a large organization, that means assessing impact across hundreds or thousands of repositories, applications, and dependencies.

Identifying exposure is only the first step. Teams then need to assess exploitability, prioritize affected applications, coordinate fixes, run tests, and get changes into production. Every handoff takes time, and speed is vital: 31% of breaches now start with vulnerability exploitation, the top initial access vector for the first time in the DBIR's 19 years.

As more critical vulnerabilities emerge, the traditional model of manually investigating findings, assigning tickets, and waiting for developers to write fixes becomes harder to sustain.

The time between vulnerability discovery and verified remediation needs to shrink dramatically. That requires security workflows capable of operating at machine speed, while preserving the controls organizations depend on to ship reliable software.

Bring agentic remediation into the software factory

AI agents can do impressive work in vulnerability discovery and remediation. The challenge is making that work reliable and repeatable across an enterprise.

An agent can generate a patch in seconds. Whether it understood the application, whether it validated the change against the real build, and whether it followed your security policies are separate questions. They get harder to answer, and more expensive to get wrong, as you deploy agents across thousands of projects.

At GitLab, we're bringing agentic security workflows into the environment where teams develop, test, and ship software.

Everything an agent does rests on how well it understands your system, and that understanding extends beyond the repository. GitLab Orbit, a live context graph of your software lifecycle, connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix. It's also how you answer the questions that follow a disclosure like PHP2Shell: Are we exposed? Is it reachable? How far does it spread, and how do we fix it without breaking production?

GitLab Duo Agent Platform investigates findings in the context of your software and how it's built, filtering out likely false positives and prioritizing by exploitability and reachability.

For the findings that matter, Duo writes a fix and puts it through your pipeline to check for regressions and rerun security scans. In a single merge request, developers review the change, Duo's explanation, and the pipeline results.

Security teams move from understanding exposure to initiating remediation in one pass, and developers shift from chasing findings to reviewing fixes. Because these workflows run inside the software factory, agents operate within the same processes and controls that organizations already use to deliver software.

That's how we turn agentic security from an isolated capability into something an enterprise can trust and operate across thousands of projects, at machine speed.

Put frontier AI to work on the most critical vulnerabilities

Some of the most dangerous application vulnerabilities require a deep understanding of how software is intended to work: missing authorization checks, broken ownership logic, and business logic flaws that expose customer data or let users take actions they shouldn't.

Traditional scanners struggle with these issues because finding them requires reasoning about the application's behavior and the relationships between components.

Our new Business Logic Security Analyzer, the first GitLab capability to support Anthropic's Claude Mythos 5.1, examines how your application enforces its rules: it reads the whole repository and incoming merge requests, infers what each endpoint should enforce, and flags the gaps that pattern-based scanners often miss.

But the real opportunity comes from connecting those discoveries to the workflows teams already use. When a critical flaw is found, teams need to understand its impact, initiate remediation, validate the proposed fix, and ship it safely. Integrating frontier AI into the software factory creates a path to run that entire process at machine speed.

The intelligence of the model is only as valuable as your ability to act on it.

Prevent risky code from reaching production

Finding vulnerabilities earlier is valuable, and keeping vulnerable code and unsafe packages out of production altogether is even better. These protections become even more important as agents gain autonomy.

Security controls need to be embedded throughout the software factory and enforced independently of the people and agents making changes, with every change clearing the same gates before it moves forward.

GitLab Ultimate brings static analysis, dependency and container scanning, secret detection, policy enforcement, and approval gates directly into the software delivery process. Those policies are set centrally and apply consistently across projects and pipelines, so the author of a change, human or agent, cannot change or waive the controls evaluating its work.

The same scrutiny needs to extend to third-party software. Modern applications rely heavily on open source dependencies, and a vulnerable or malicious package can introduce serious risk before developers write a single line of code.

GitLab's Dependency Firewall blocks policy-violating packages before they enter your build. GitLab Secrets Manager lets each job access only the credentials it requests and is authorized to use, so a compromised dependency can reach only the secrets of the job it runs in.

Agents need the freedom to work quickly, within boundaries they can't cross. GitLab Duo Agent Platform gives each agent a composite identity that limits it to the permissions it shares with the requesting user, a sandbox that's destroyed when the task ends, and a record of every action. These boundaries are part of the GitLab Security Standard, under which agents earn more autonomy only as the controls at each stage are proven to hold.

The controls that make a change trustworthy need to hold at every step, even when the work happens at machine speed.

The next chapter of security will be defined by trusted execution

Frontier models will keep improving, security agents will get more capable, and vulnerabilities that were once difficult to discover will become easier to find. That progress will put enormous pressure on how organizations respond.

A security team can deploy the most advanced models available, but its ability to reduce risk will still depend on how quickly and safely it can turn findings into production-ready fixes.

This is why the software factory matters. It's where agents get the context needed to understand applications, where changes are validated against real builds and tests, where security policies are enforced, and where human oversight applies without slowing every step of the process.

At GitLab, we're bringing these capabilities together so you can automate remediation, uncover complex flaws, and prevent unsafe changes from shipping, all inside the workflows you already use.

The next security advantage will come from how quickly organizations can turn a critical discovery into a verified, trusted fix.

We invite you to run your next security sprint on us. Qualifying teams can request access to GitLab Ultimate, GitLab Duo Agent Platform, GitLab Orbit, and GitLab Secrets Manager, with free credits. Request access to the security sprint offer.