GitLab used its Transcend event to announce the “governed software factory”. The pitch is that AI agents can now write code faster than anyone can review it, and the software supply chain needs a control plane to match. The timing is good. Most of the products are not yet ready.
What GitLab announced
The launch spans seven capabilities. Artifact Central brings containers and packages into one organisation-level registry. Dependency Firewall checks packages against policy before they enter a build. Secrets Manager centralises build-time credentials.
Orbit maps the software lifecycle into context agents can use. Impact Analytics reports AI cost and impact by team, task and model.
GitLab also published a Security Standard, with five controls and a metric of time from detection to verified remediation.
The framing is a “shadow software factory”: separate tools for coding, issue tracking, source control, CI/CD, security and deployment, with no shared identity or common policy.
The software supply chain problem is now measured
That framing is not marketing. The software supply chain has become a live attack surface, and the attackers have moved to trusted maintainers.
The Shai-Hulud worm family is the first self-replicating supply chain threat at npm scale. Across at least three campaigns it has compromised more than 796 packages with over 20 million combined weekly downloads.
The August 2026 wave hit the keyv and cacheable ecosystems. Sonatype tracked 2,225 compromised component versions. JFrog reported more than 400 packages across 1,700-plus versions. Elastic put the affected packages at over 1.3 billion monthly downloads.
The malware steals npm, GitHub, cloud, Kubernetes, Vault and CI/CD credentials, then uses stolen publishing tokens to infect the next package. Guidance from the UK’s NCSC notes that CI/CD automation is what lets such packages spread without human approval.
It targets AI tooling directly
The detail that matters most for GitLab’s launch is what the malware goes after. Recent campaigns explicitly target AI developer tooling credentials, including Anthropic, Claude, Codex, Cursor, OpenAI and Gemini.
Some variants also target IDE configuration files, such as.claude/settings.json and.vscode/tasks.json, and install persistence through agent hooks. Removing the package does not remove the infection.
That is precisely the layer GitLab is now governing. Dependency Firewall blocks packages by vulnerability severity, malicious status, license and package age, before install. Secrets Manager scopes credentials to the job that needs them and records every event in the audit trail.
The code the agents write
The second half of the problem is the code itself. Independent benchmarks are blunt about it.
SUSVIBES found SWE-Agent with Claude 4 Sonnet produced functionally correct solutions on 57% of tasks, but secure ones on only 11.8%. Endor Labs, running the same benchmark, found the best configuration reached 84.4% functional correctness and just 7.8% security correctness — a median gap of 45 percentage points.
A formal verification study found 55.8% of AI-generated artifacts contained at least one vulnerability, and that six industry tools combined missed 97.8% of the formally proven findings. A study of 3,171 public repositories found 16% of AI coding-agent setups carried a security defect.
GitLab’s answer is to move the checks into the pipeline, under the same identity and evidence chain, rather than bolting them on after review.
The catch in the Mythos flows
The headline security feature is that Anthropic’s Claude Mythos 5 and 5.1 will power new Duo Agent Platform flows to find and fix vulnerabilities.
There is a catch. Claude Mythos 5 is not generally available. Anthropic restricts it to organisations verified through programs such as its Cyber Verification Program, beginning with Project Glasswing partners.
GitLab hedges, saying the flows help “organizations with approved environments”. That is accurate, and it means the most capable part of the launch depends on a third-party access decision most buyers cannot make for themselves.
What is actually available
Read the availability lines closely. Artifact Central is in beta. Dependency Firewall is early access. Impact Analytics is early access.
Orbit reaches general availability next month. Secrets Manager is generally available on GitLab.com, and on self-managed in the 19.5 release. Only the Security Standard is available today.
The efficiency figures — up to 50% lower total cost of ownership, up to 45x fewer retries — are GitLab’s own, without published methodology.
What to watch
Whether Dependency Firewall reaches general availability, because blocking a package at install is the control that would have stopped the Shai-Hulud waves. Whether the Mythos-powered flows broaden beyond verified organisations. And whether buyers demand third-party measurement of the retry and token claims, since those are the numbers the cost case rests on.
GitLab has pointed its governance layer at the right two problems. The evidence says both are real, and both are getting worse. The question is how much of the answer is shipping now, and how much is a roadmap.
Editor’s Note
This analysis draws on GitLab‘s Transcend announcements and product documentation, Anthropic’s Claude Mythos 5 release material and access terms, security research on the Shai-Hulud campaign from Microsoft, Sonatype, JFrog, Elastic, Palo Alto Networks Unit 42 and the UK NCSC, and independent benchmarks on AI-generated code security including SUSVIBES, Endor Labs and published formal verification studies. Where a figure is a vendor’s own or an estimate, we say so.