GitLab 18.11 Ships Agentic CI Setup, Autonomous Vulnerability Fixes, and Live Analytics as Duo Agent Platform Matures
GitLab's April release adds a CI Expert Agent that generates pipelines from repository analysis, moves Agentic SAST vulnerability resolution to GA, and delivers natural-language DevOps analytics.
Overview
GitLab released version 18.11 on April 16, 2026, marking the most significant expansion of its Duo Agent Platform since the agentic tooling entered general availability in early 2026. The release introduces two new foundational agents — one that generates CI/CD pipelines from a repository scan, and one that delivers natural-language answers over live development metrics — alongside the general availability of automated vulnerability remediation that writes and opens its own merge requests.
What We Know
CI Expert Agent Removes the Blank-Slate Problem
One of the highest-friction moments in adopting CI/CD has always been writing the initial .gitlab-ci.yml from scratch. The new CI Expert Agent, shipping in beta with GitLab 18.11, addresses this directly. According to GitLab’s press release, the agent inspects a repository, identifies its language and framework, and proposes a build-and-test pipeline through a natural-language interface — targeting a functional running pipeline within minutes without a single line of YAML written manually.
The agent draws on context from across the GitLab platform, including code repositories, issue tracking, and prior pipeline execution data, to tailor its output. GitLab frames this as part of a broader strategy: agents are only as effective as the context they can access, and the platform’s integrated design gives them an informational edge over point solutions that must reconstruct project context from scratch.
Agentic SAST Reaches General Availability
Agentic SAST Vulnerability Resolution, previously in limited availability, is now generally available for GitLab Ultimate customers. As reported by Help Net Security, the feature closes a workflow gap that the company’s own 2025 DevSecOps Report quantified: developers spend an average of eleven hours per month remediating vulnerabilities after release, with most of that time consumed by context-switching between security tools and code editors.
The automated workflow triggers when a SAST scan completes on the main branch. The agent analyzes confirmed true positives at High and Critical severity, generates a code fix aimed at the root cause rather than a surface-level patch, and opens a ready-to-merge request with a confidence score attached. Developers can also trigger resolution manually from the vulnerability report for any severity level. According to the official documentation, the system uses multi-shot reasoning to handle complex patterns, though it will decline to generate a fix when code context is insufficient or when the AI model classifies a finding as a likely false positive.
The feature requires GitLab 18.9 or later, a configured Duo Agent Platform namespace, and SAST False Positive Detection enabled at both group and project levels.
Data Analyst Agent Goes Broadly Available
Rounding out the agent additions, the Data Analyst Agent reaches general availability across all tier levels — Free, Premium, and Ultimate — for users with Duo Agent Platform enabled. As detailed in the GitLab release notes, the agent answers natural-language queries about live software lifecycle data and surfaces visual outputs covering merge request cycle times, pipeline health, and deployment frequency. The feature uses ClickHouse as its analytics backend, extending a database integration GitLab has been building out across its advanced analytics dashboards.
Security Policy and Scanning Enhancements
Beyond the agent additions, GitLab 18.11 ships several incremental improvements to its security posture tooling. Merge request approval policies can now incorporate Known Exploited Vulnerabilities catalog data and EPSS exploit probability scores to automatically block high-exploitability findings from merging. CVSS 4.0 scoring support replaces the previous CVSS 3.x-only workflow for vulnerability assessment. Dependency scanning now generates dependency graphs for Maven and Python projects without requiring a lock file, broadening coverage for teams that do not commit their lock files.
Advanced SAST gains incremental scanning support, limiting analysis to changed code sections on subsequent runs and substantially reducing scan times for large repositories.
Infrastructure and Upgrade Notes
The release fully supports Kubernetes 1.35, and Gitaly — GitLab’s Git data layer — can now be deployed on Kubernetes as a fully supported configuration rather than as an experimental option. Non-clustered installations will receive an automatic PostgreSQL 17 upgrade; clustered deployments require a manual upgrade path. The default agentic chat model for Duo has been upgraded from Claude Haiku 4.5 to Claude Sonnet 4.6 on Vertex AI, improving the quality of reasoning-heavy interactions across the platform.
What We Don’t Know
GitLab has not disclosed the CI Expert Agent’s promotion timeline from beta to general availability, nor has it published benchmark data comparing its pipeline generation quality against hand-written configurations or competing tools. The confidence score metric attached to Agentic SAST merge requests is not publicly defined: it is unclear what thresholds GitLab considers high-confidence versus uncertain, or how the score is calculated. The full list of programming languages supported by the Agentic SAST analyzer is not specified in the release documentation.
Analysis
The 18.11 release reflects a pattern GitLab has been executing since it introduced the Duo Agent Platform earlier in 2026: converting manual, interrupt-driven developer workflows into asynchronous agent tasks. The CI Expert Agent and Agentic SAST resolver share a structural similarity — both are designed to surface their outputs as reviewable artifacts (a pipeline proposal and a merge request, respectively) rather than applying changes automatically. This positions them as acceleration tools rather than autonomous actors, keeping humans in the approval loop while eliminating the most time-consuming parts of the work.
The move to make the Data Analyst Agent available on the free tier is notable: it brings one of the more visible Duo capabilities to a broader audience without requiring an Ultimate license, potentially serving as a conversion lever toward paid tiers while demonstrating the platform’s analytics depth to development teams that have not yet adopted GitLab’s premium security features.
The broader context is competitive pressure from GitHub, which has been moving its own Copilot capabilities steadily down the DevOps pipeline toward deployment and security workflows. GitLab’s advantage remains its single-platform architecture — the agents in 18.11 draw on issue tracking, pipeline history, and scan results simultaneously, a cross-domain context window that GitHub and tool-specific agents must reconstruct from integrations.