GitLab

Every senior engineer carries years of "I've seen this before" in their head, while every AI agent starts from zero, and that gap is the real ceiling on agentic development speed. GitLab Orbit closes it with a live graph connecting your code, tickets, pipelines, deployments, and production alerts, built from years of pipeline history to scan every past incident and surface the exact pattern behind any failure in seconds. Demo Orbit today on the GitLab Demo Hub. https://lnkd.in/eXBb97Dp

Owning a runner fleet means constantly fighting the trade-off between over-provisioning and paying for idle capacity, or under-provisioning and making your developers wait. Hosted Runners for GitLab Dedicated shifts that operational burden to GitLab, helping teams balance capacity and cost. GitLab now provisions, patches, and scales your runner infrastructure in the same region as your GitLab Dedicated instance. Every job runs in a newly provisioned, isolated VM that's deleted the moment the job completes, so you get the same data residency and job-level security without staffing the operations yourself. Runners can connect to your internal artifact registries, secret managers, and deploy targets through AWS PrivateLink connections, and the whole fleet is backed by a 99.9% availability SLA. Creating and managing runners is self-serviceable through Switchboard, and usage can draw down from GitLab Credits. As agentic workflows push more volume through the pipeline, this is how platform teams stop managing infrastructure and get back to shipping. Read more about Hosted Runners for GitLab Dedicated: https://lnkd.in/eSRgbu2g

AI adoption in software development isn't slowing down, and security teams can't afford to stay on the sidelines. In a new interview with ITPro, GitLab CISO Chaim Mazal makes the case for an "engineering-first" security model: one where security teams contribute code, iterate alongside engineering, and help build the guardrails from day one rather than reviewing after the fact. The shift matters because the old audit-and-approve model wasn't built for agentic AI and the pace it brings. Mazal's take: automate everything you safely can, keep humans in the loop only where risk demands it, and bake governance into the design phase, not the end of the pipeline. Read the full piece: https://lnkd.in/emesVnUY

AI is helping developers ship faster, and it's helping attackers exploit vulnerabilities faster too. GitLab 19.3 brings automation and security remediation to scale with bulk SAST triage and remediation, restricted visibility for custom agents and flows, Flow Creator Agent, and GitLab Credits usage caps. ✨ What's new: ➡️ GitLab Secrets Manager, now in limited availability, injects each secrets directly into the CI job that needs it, scoped to that job's environment and branch, with no separate permission model to maintain ➡️ Flow Creator Agent lets anyone describe an automation in plain English and get back a complete, runnable flow definition, ready to register from the AI Catalog. ➡️ Bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution lets teams triage and remediate their entire vulnerability backlog in one action instead of one finding at a time. ➡️ Restricted visibility for custom agents and flows, now generally available, lets teams share agents and flows across a top-level group without making them public. …and more! Read the full 19.3 release notes: https://lnkd.in/e73aYSAv 🚀

According to the 2026 Verizon Data Breach Investigation Report, vulnerability exploitation just overtook credential abuse as the top breach entry point, and only 26% of known exploited vulnerabilities get remediated. GitLab 19.3 brings bulk triage and remediation to your production vulnerability backlog. Select multiple vulnerabilities in the report, run false positive detection and remediation in one action, no more clearing findings one by one. Pipeline capacity stays protected with built in concurrency limits, and you can track or cancel the job anytime. Learn more. https://lnkd.in/eC9UXrV5

The person who knows exactly what should be automated isn’t always the person who knows how to write the automation using a schema. Flow Creator Agent, new in GitLab 19.3, closes that gap. Describe the flow you want in plain language and get back a complete, runnable definition, and if anything's unclear, Flow Creator asks before it builds. Watch the demo to see it in action and read the blog to learn more. https://lnkd.in/e9shMxsG

AI Gateway for GitLab Dedicated is here: run agentic software delivery without stepping outside the boundaries you already trust. GitLab Dedicated customers can now deploy the AI Gateway for GitLab Duo Agent Platform inside their single-tenant environment, so AI processing stays in-region and inference follows the data policy you choose. Connect to Amazon Bedrock in your AWS region out of the box, or bring your own preferred model provider. That means the isolation, residency, and SLA guarantees your auditors already understand now extend to your AI inference path too, not just your source code and SDLC. Read how to get started: https://lnkd.in/eapzja8j

✨What’s new in GitLab this month! GitLab Dedicated AI Gateway, now generally available, brings agentic AI to regulated and data-sensitive enterprises, letting them run GitLab Duo Agent Platform on GitLab Dedicated in their single tenant environment and region. Today also launches GitLab 19.3 release. With GitLab 19.3, teams can deliver secrets wherever they're used, inside CI or out, turn everyday process knowledge into automation without learning a schema, clear years of accumulated vulnerability risk in a single action, share custom agents and flows across their organization without making them public, and inject secrets directly into the CI job that needs them. Highlights include: ➡️ GitLab Secrets Manager, now in limited availability, injects each secret into the CI job that needs it, scoped to that job's environment and branch, and now also works in Kubernetes, infrastructure as code, or by API, with no separate permission model to maintain. ➡️ Flow Creator Agent lets anyone describe an automation in plain English and get back a complete, runnable flow definition ready to register from the AI Catalog. ➡️ Bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution let teams triage and remediate their entire vulnerability backlog in bulk instead of one finding at a time. ➡️ Restricted visibility for custom agents and flows, now generally available, lets teams roll out agents and flows across a top-level group without exposing them publicly. Learn more about everything that shipped this month: https://lnkd.in/eScc27N9 Ready to dive deeper? The blogs are linked in the comments.

Preventing Rogue Agents: Building Agents You Can Trust AI agents are moving from generating suggestions to taking action across the software lifecycle. The real challenge is not only stopping bad behavior. It is building agents that are useful because they have the right context, bounded permissions, visible actions, human checkpoints, and clear recovery paths.