--- title: Security at machine speed. Control at every step. description: GitLab is integrating Anthropic's Claude Mythos 5.1 into its platform to connect vulnerability discovery, remediation, and prevention into one agentic... canonical: https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security at machine speed. Control at every step. | daily.dev og:description: GitLab is integrating Anthropic's Claude Mythos 5.1 into its platform to connect vulnerability discovery, remediation, and prevention into one agentic... og:url: https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1 og:image: https://api.daily.dev/og/posts/iMPvI7qE1.png og:image:alt: Security at machine speed. Control at every step. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security at machine speed. Control at every step. **[GitLab](https://daily.dev/sources/gitlab)** · 10 min read · 0 upvotes · 0 comments ## Summary GitLab is integrating Anthropic's Claude Mythos 5.1 into its platform to connect vulnerability discovery, remediation, and prevention into one agentic workflow. The median time to fully remediate a known-exploited vulnerability rose to 43 days in 2026, up from 32 in 2025, per Verizon's DBIR. Vulnerability exploitation now drives 31% of breaches, the top initial access vector in the report's 19-year history. GitLab's new Business Logic Security Analyzer reads repositories and merge requests to flag missing authorization checks and logic flaws. GitLab Duo Agent Platform investigates findings, writes fixes, and runs them through pipelines, while a Dependency Firewall and Secrets Manager add guardrails around third-party dependencies and credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the median time to remediate a known-exploited vulnerability according to the 2026 Verizon DBIR? The median time to fully remediate a known-exploited vulnerability is 43 days, up from 32 days in 2025. Verizon's 2026 Data Breach Investigations Report also found that vulnerability exploitation now accounts for 31% of breaches, becoming the top initial access vector for the first time in the report's 19-year history. _Security teams tracking remediation speed and breach trends can follow reports like this on daily.dev._ ### What does GitLab's Business Logic Security Analyzer do? It examines how an application enforces its own rules by reading the whole repository and incoming merge requests, inferring what each endpoint should enforce, and flagging gaps that pattern-based scanners typically miss. It is the first GitLab capability built on Anthropic's Claude Mythos 5.1, targeting issues like missing authorization checks and broken ownership logic. _Developers evaluating AI-driven code analysis tools can track releases like this on daily.dev._ ### How does GitLab limit the autonomy of AI security agents to prevent unsafe changes? Each agent gets a composite identity limited to the permissions shared with the requesting user, runs in a sandbox destroyed when the task ends, and has every action recorded. Agents earn more autonomy only as controls at each stage are proven to hold, under the GitLab Security Standard, and centrally set policies cannot be changed or waived by the author of a change, human or agent. _Teams weighing how much autonomy to grant coding agents can follow these guardrail patterns on daily.dev._ ## Similar posts on daily.dev - [Securing the software factory at machine speed](https://daily.dev/posts/securing-the-software-factory-at-machine-speed-j44zhqrq7) · GitLab · 1 upvotes · 0 comments - [GitLab Extends Agentic AI with New Automated Security Remediation, Pipeline Setup, and Delivery Analytics](https://daily.dev/posts/gitlab-extends-agentic-ai-with-new-automated-security-remediation-pipeline-setup-and-delivery-anal-v9xr4v7zm) · SD Times · 0 upvotes · 0 comments - [GitLab 19.2 Puts AI Agents to Work on the Security Backlog](https://daily.dev/posts/gitlab-19-2-puts-ai-agents-to-work-on-the-security-backlog-7nyms0ufk) · InfoQ · 1 upvotes · 0 comments - [How Anthropic Claude Mythos is reshaping the vulnerability landscape](https://daily.dev/posts/how-anthropic-claude-mythos-is-reshaping-the-vulnerability-landscape-9thbmnz6t) · Dynatrace · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#appsec](https://daily.dev/tags/appsec), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security at machine speed. Control at every step.","url":"https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1"},"datePublished":"2026-10-28T22:23:50.969Z","dateModified":"2026-10-28T23:15:37.194Z","description":"GitLab is integrating Anthropic's Claude Mythos 5.1 into its platform to connect vulnerability discovery, remediation, and prevention into one agentic...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c16f50a672956b26d4cc5a5c317aaebb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c16f50a672956b26d4cc5a5c317aaebb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitLab","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitLab","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3720ce340ca4435daef529abbf361b69","url":"https://daily.dev/sources/gitlab"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,claude,appsec,gitlab","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitLab","item":"https://daily.dev/sources/gitlab"},{"@type":"ListItem","position":3,"name":"Security at machine speed. Control at every step."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-at-machine-speed-control-at-every-step--impvi7qe1#faq","mainEntity":[{"@type":"Question","name":"What is the median time to remediate a known-exploited vulnerability according to the 2026 Verizon DBIR?","acceptedAnswer":{"@type":"Answer","text":"The median time to fully remediate a known-exploited vulnerability is 43 days, up from 32 days in 2025. Verizon's 2026 Data Breach Investigations Report also found that vulnerability exploitation now accounts for 31% of breaches, becoming the top initial access vector for the first time in the report's 19-year history. Security teams tracking remediation speed and breach trends can follow reports like this on daily.dev."}},{"@type":"Question","name":"What does GitLab's Business Logic Security Analyzer do?","acceptedAnswer":{"@type":"Answer","text":"It examines how an application enforces its own rules by reading the whole repository and incoming merge requests, inferring what each endpoint should enforce, and flagging gaps that pattern-based scanners typically miss. It is the first GitLab capability built on Anthropic's Claude Mythos 5.1, targeting issues like missing authorization checks and broken ownership logic. Developers evaluating AI-driven code analysis tools can track releases like this on daily.dev."}},{"@type":"Question","name":"How does GitLab limit the autonomy of AI security agents to prevent unsafe changes?","acceptedAnswer":{"@type":"Answer","text":"Each agent gets a composite identity limited to the permissions shared with the requesting user, runs in a sandbox destroyed when the task ends, and has every action recorded. Agents earn more autonomy only as controls at each stage are proven to hold, under the GitLab Security Standard, and centrally set policies cannot be changed or waived by the author of a change, human or agent. Teams weighing how much autonomy to grant coding agents can follow these guardrail patterns on daily.dev."}}]} ```