GitLab Expands Agentic AI for Secure Software Delivery

GitLab expands agentic AI for secure software delivery with new capabilities designed to give enterprises greater control as they adopt AI-powered development at scale. The latest updates extend GitLab Duo Agent Platform into regulated and data-sensitive environments while adding stronger secrets management, automated security remediation, custom AI workflows, and spending controls.

The enhancements are part of GitLab 19.3 and reflect the company's broader strategy of combining agentic AI with security, governance, and software delivery workflows. As organizations generate more code with AI, they need mechanisms that allow teams to move faster without losing control over sensitive data, credentials, vulnerabilities, and AI spending.

GitLab Brings Agentic AI to Sensitive Environments

A major component of the announcement is the general availability of the AI Gateway for GitLab Duo Agent Platform within GitLab Dedicated single-tenant SaaS environments.

The capability allows organizations with strict security, compliance, and data-residency requirements to run agentic AI within the same environment where they already manage sensitive software delivery workloads. Enterprises can also connect their own models for inference while keeping AI-processed information inside their existing security boundary.

This deployment model can be particularly valuable for regulated industries and organizations that need greater control over where software development and AI workloads are processed.

Strengthening Security With GitLab Secrets Manager

GitLab is also expanding its approach to credential management through GitLab Secrets Manager. The service is now available in limited availability as a paid add-on for GitLab.com customers.

Secrets Manager is designed to protect and manage credentials used both inside and outside CI/CD pipelines. It applies a common permission model to secrets and supports environments including Kubernetes, Terraform, OpenTofu, and custom tools.

Bringing these credentials into the same platform used to manage software development and pipelines can reduce the need for organizations to maintain separate security and access-control systems.

This approach can also help security teams establish more consistent policies around sensitive credentials as development environments become increasingly automated.

AI-Powered Vulnerability Remediation

GitLab is expanding agentic AI into application security with Bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution, both introduced in beta.

The capabilities allow security teams to review large numbers of security findings rather than handling vulnerabilities individually. GitLab can provide confidence scores for findings and identify confirmed risks that require remediation.

For confirmed vulnerabilities, the platform can generate a ready-to-merge fix. Developers can then review the proposed change rather than starting the remediation process from scratch.

This approach is designed to address a common challenge in modern application security: organizations can identify vulnerabilities faster than development teams can resolve them.

Clearing Security Backlogs With Automation

AI-generated code can increase development speed, but it can also contribute to larger security backlogs. GitLab's agentic security capabilities are designed to help organizations address this growing workload.

Teams can select multiple findings from the Vulnerability Report and use AI-assisted capabilities to triage and remediate confirmed risks. GitLab also says the system can continue handling new critical and high-severity SAST findings as they appear.

By automating repetitive security tasks, organizations can allow security professionals to focus more heavily on complex risks and strategic security initiatives.

Flow Creator Agent Simplifies Custom Automation

Another addition is the Flow Creator Agent, which is now generally available. The tool allows users to describe an automation workflow using natural language rather than manually mapping the required schema.

The agent can turn a plain-language description into a complete, runnable flow that can be registered through GitLab's AI Catalog.

This capability is intended to make custom automation accessible to process owners who may not have extensive technical knowledge of workflow schemas.

GitLab still applies controls to these workflows. Each flow operates through a scoped service account with composite identity, and enabling a flow requires the Maintainer role or higher.

Greater Control Over AI Spending

As enterprises deploy more AI agents, managing AI-related costs becomes increasingly important. GitLab has therefore added usage controls that allow organizations to establish monthly spending limits for agentic AI.

GitLab Credits usage caps are now generally available, allowing administrators to set subscription-level ceilings and configure default or individual user limits.

These controls can help organizations make agentic AI adoption more predictable by preventing unexpected usage from generating excessive costs.

For large enterprises rolling out AI across multiple teams, spending controls can provide an additional layer of financial governance.

Managing Custom Agents Across Teams

GitLab 19.3 also introduces restricted visibility for custom agents and flows at the group level. This allows organizations to make selected AI capabilities available to members across multiple projects within a GitLab group.

The feature builds on existing project-level and public visibility options and gives administrators more flexibility when managing AI tools across larger organizations.

This type of access management can help enterprises establish clear boundaries around which teams can use specific agents and automated workflows.

Agentic AI Across the Software Lifecycle

GitLab's latest updates build on its broader strategy of applying AI agents across the entire software development lifecycle. The company made GitLab Duo Agent Platform generally available in January 2026, positioning it as a way to orchestrate AI agents across software planning, development, security, and delivery.

The strategy addresses what GitLab describes as the AI paradox in software delivery. AI can dramatically accelerate code creation, but writing code represents only part of a developer's overall work.

Agentic AI can therefore provide additional value by automating tasks that occur before and after coding, including security analysis, testing, workflow management, and other software delivery processes.

Balancing AI Speed With Enterprise Governance

As organizations adopt agentic development, maintaining governance becomes increasingly important. AI agents can perform tasks with greater autonomy than traditional productivity tools, creating new requirements around permissions, security, data protection, and accountability.

GitLab's approach focuses on embedding these controls directly into software delivery workflows. The company has emphasized enterprise guardrails, unified context, and governance as important components of its intelligent orchestration strategy.

This allows enterprises to pursue automation while retaining control over how agents access systems, use credentials, process information, and execute workflows.

Supporting Secure AI-Driven Development

The latest release comes as enterprises move from experimenting with AI coding tools toward broader adoption. GitLab research has highlighted concerns about managing the volume of AI-generated code, with organizations increasingly looking for ways to maintain security and governance as AI adoption grows.

By bringing AI capabilities deeper into the DevSecOps lifecycle, GitLab aims to help organizations manage these challenges from a unified platform.

Security teams can use AI to reduce vulnerability backlogs, developers can receive ready-to-merge remediation suggestions, and process owners can build custom workflows using natural language. At the same time, administrators can establish spending and access controls.

GitLab Strengthens Its Agentic AI Strategy

GitLab's latest agentic AI expansion demonstrates a broader shift toward AI-powered software delivery where automation is integrated across development, security, operations, and governance.

The combination of Dedicated AI Gateway, Secrets Manager, agentic vulnerability remediation, Flow Creator Agent, and AI spending controls gives enterprises additional tools for deploying AI while maintaining established security boundaries.

For organizations operating in regulated or data-sensitive environments, the ability to keep AI workloads within controlled infrastructure could be particularly significant. Meanwhile, automated security remediation and workflow creation can help teams address some of the operational bottlenecks created by faster AI-assisted development.

As enterprises continue scaling agentic AI, the ability to combine productivity with security and governance will become increasingly important. GitLab's latest capabilities position its platform to support that transition by giving organizations more automation while preserving control across the software delivery lifecycle.

Discover IT Tech News for the latest updates on IT advancements and AI innovations.