GitLab brings Anthropic's Claude Mythos 5.1 into its security workflow

Remediation is slowing while discovery speeds up

GitLab argues that frontier AI models are finding complex flaws that traditional tools missed, while attackers use the same models to exploit them faster. Remediation is not keeping pace. According to Verizon's 2026 Data Breach Investigations Report (DBIR), the median time to fully remediate a known-exploited vulnerability is 43 days, up from 32 in 2025.

The report also found that 31% of breaches now start with vulnerability exploitation, which is the top initial access vector for the first time in the DBIR's 19 years. GitLab points to critical vulnerabilities such as PHP2Shell, which force large organizations to assess exposure across hundreds or thousands of repositories, applications and dependencies, then judge exploitability, prioritize, coordinate fixes, test and deploy.

GitLab says agents can generate a patch in seconds, but it is a separate question whether the agent understood the application, validated the change against the real build and followed security policies. Those questions become harder and costlier as agents spread across thousands of projects.

Agents inside the software factory

GitLab's answer is to run agentic security work inside the environment where teams already develop, test and ship software. Several components are involved:

• GitLab Orbit, described as a live context graph of the software lifecycle, connects findings to the changes that introduced them, the pipelines that shipped them and the teams who own the fix.
• GitLab Duo Agent Platform investigates findings in context, filters out likely false positives and prioritizes by exploitability and reachability. For the findings that matter, Duo writes a fix and runs it through the pipeline to check for regressions and rerun security scans.
• A single merge request shows developers the change, Duo's explanation and the pipeline results for review.

According to GitLab, security teams can move from understanding exposure to starting remediation in one pass, while developers shift from chasing findings to reviewing fixes.

The new Business Logic Security Analyzer is the first GitLab capability to support Claude Mythos 5.1. GitLab says it targets flaws such as missing authorization checks, broken ownership logic and other business logic errors that pattern-based scanners often miss. It reads the whole repository and incoming merge requests, infers what each endpoint should enforce and flags the gaps.

Keeping risky code out of production

GitLab stresses that controls must be enforced independently of the people and agents making changes. GitLab Ultimate includes static analysis, dependency and container scanning, secret detection, policy enforcement and approval gates. Policies are set centrally, so the author of a change, human or agent, cannot change or waive the controls evaluating its work.

For third-party code, GitLab's Dependency Firewall blocks policy-violating packages before they enter a build. GitLab Secrets Manager lets each job access only the credentials it requests and is authorized to use, so a compromised dependency can reach only the secrets of the job it runs in.

Each agent on Duo Agent Platform gets a composite identity that limits it to the permissions it shares with the requesting user, a sandbox that is destroyed when the task ends and a record of every action. These boundaries belong to the GitLab Security Standard, under which agents earn more autonomy only as the controls at each stage are proven to hold.

What it means for security teams

GitLab's position is that better models alone will not cut risk. A team's ability to reduce risk depends on how quickly and safely it can turn findings into production-ready fixes, and the company says the next security advantage will come from doing that with verified, trusted changes.

GitLab is also offering a security sprint program. Qualifying teams can request access to GitLab Ultimate, GitLab Duo Agent Platform, GitLab Orbit and GitLab Secrets Manager, with free credits. The source gives no further details on pricing or availability beyond that request process.