GitLab 18.10 brings AI-native triage and remediation

GitLab 18.10 adds AI-powered security features designed to reduce vulnerability triage noise and speed remediation. GitLab Duo Agent Platform can assess whether SAST and secret-detection findings are likely false positives, explain its reasoning, and— for verified SAST issues—generate tested fixes in merge requests. These capabilities are available to GitLab Ultimate customers using the Duo Agent Platform, with some features still in beta.

SAST False Positive Detection

• Generally available for new critical and high-severity SAST findings.
• Uses LLM-based agentic reasoning to assess whether a vulnerability is likely real or a false positive.
• Adds:
  • A confidence score
  • An AI-generated explanation
  • A “Likely false positive” or “Likely real” badge
• Findings can be filtered in the Vulnerability Report so teams can prioritize likely real vulnerabilities.
• The assessment remains a recommendation that teams can review and audit.

Agentic SAST Vulnerability Resolution

• Currently in beta.
• For findings judged unlikely to be false positives, the agent:
  • Reads the vulnerable code and its surrounding context
  • Generates a proposed fix
  • Validates the fix with automated tests
  • Opens a merge request for developer review
• The merge request includes code changes, a confidence score, and an explanation of the remediation.
• Developers should still carefully review AI-generated changes before merging.

Secret False Positive Detection

• Currently in beta.
• Identifies likely test credentials, placeholder values, example tokens, and other dummy secrets.
• Provides confidence scores, explanations, and visual badges in the Vulnerability Report.
• Runs automatically on the default branch and can also be triggered manually with “Check for false positive.”
• The goal is to help teams focus on exposed credentials that represent genuine risk.

GitLab 18.10 extends AI assistance across the vulnerability lifecycle: filtering out misleading findings, explaining security assessments, and proposing validated code fixes. Teams using GitLab Ultimate and Duo Agent Platform can use these features to reduce review effort while retaining human control over security decisions and merges.