GitLab 18.11 Makes Agentic SAST Vulnerability Resolution Generally Available, Adds Hard Credit Caps and CI Pipeline Agent
GitLab's April 16 release graduates a security agent that opens ready-to-merge fixes for confirmed SAST findings, ships a beta CI pipeline agent and a generally available analytics agent, and gives administrators enforceable monthly caps on Duo Agent Platform credits.
Overview
GitLab released version 18.11 of its DevSecOps platform on April 16, 2026, graduating its Agentic SAST Vulnerability Resolution feature to general availability, adding two more agents to the GitLab Duo Agent Platform, and giving administrators hard monthly spending caps on the AI credits that power those agents. The update lands roughly three months after the GitLab Duo Agent Platform reached general availability in January 2026, and one minor version after 18.10 opened paid agent access to free-tier groups via consumption-based GitLab Credits, as InfoQ reported.
Agentic SAST Vulnerability Resolution Reaches General Availability
The headline feature is Agentic SAST Vulnerability Resolution, now generally available for customers on the GitLab Ultimate tier with the Duo Agent Platform enabled. According to GitLab’s release blog post, the agent runs after a SAST scan completes and after the existing SAST false positive detection step. For findings classified as confirmed true positives, the agent analyzes the surrounding code, generates a candidate fix targeting the root cause, validates it through automated testing, and opens a ready-to-merge request that includes a confidence score for the reviewer.
GitLab frames the feature against a number from its 2025 DevSecOps Report, which it cites as showing that developers spend 11 hours per month remediating vulnerabilities after release, according to the company’s blog post.
Two More Agents Join the Duo Platform
GitLab 18.11 also introduces two foundational agents on the Duo Agent Platform aimed at common gaps in the development lifecycle, according to GitLab’s product blog post.
The CI Expert Agent, now in beta, inspects a repository to identify its language, framework, and existing test setup, then proposes a build-and-test pipeline expressed in native GitLab CI syntax. The agent is available on GitLab.com, self-managed, and Dedicated installations across the Free, Premium, and Ultimate editions, provided the Duo Agent Platform is enabled, per the GitLab post.
The Data Analyst Agent ships as generally available with the same tier coverage. Through Agentic Chat, it answers natural-language questions about merge requests, issues, projects, pipelines, and jobs, and produces visualizations of metrics such as merge request cycle time, pipeline performance, and deployment frequency, GitLab writes. Generated GitLab Query Language queries can be copied and used anywhere GitLab Flavored Markdown is supported, with direct export to work items and dashboards on the roadmap.
Enforceable Caps Replace Advisory Limits
The other operational change in 18.11 targets the cost side of agent adoption. GitLab’s budget guardrails post describes a two-level system that, in contrast to advisory warnings, automatically pauses access when limits are hit.
A subscription-level cap, configured in the Customers Portal, sets a hard monthly ceiling on on-demand GitLab Credits consumption. When usage reaches the cap, Duo Agent Platform access is paused for all users on the subscription until the next monthly period begins, and billing account managers receive email notification of the enforcement, GitLab writes. The cap can be adjusted mid-month to restore access.
A second mechanism applies per-user caps through the GraphQL API, either as a uniform flat cap or as differentiated overrides that let administrators give heavier-using engineers larger allocations. When an individual user reaches their cap, only their Duo Agent Platform credit usage pauses; access for other users on the same subscription is unaffected, according to the same post. GitLab cautions that usage data syncs periodically rather than in real time, so a small amount of additional consumption may occur between cap-crossing and enforcement.
The cost controls follow the consumption-based pricing GitLab introduced in 18.10. Per InfoQ’s coverage, GitLab charges a flat $0.25 per automated code review regardless of merge request size, a structure the company contrasts with token-based pricing from competitors that it says ranges from $15 to $25 per review. InfoQ also reports that 18.11 adds an integration with Google Cloud’s Vertex AI: when customers select Google Cloud as their inference environment, model calls are routed through Vertex AI via GitLab’s AI Gateway, with the capability available to both GitLab.com customers and self-managed installations on 18.11 or later.
What We Don’t Know
GitLab has not published independently audited measurements of how often the Agentic SAST Vulnerability Resolution agent’s proposed fixes are merged without modification, how often they introduce regressions, or how the confidence score correlates with reviewer decisions in production. The 11-hours-per-month remediation figure GitLab uses to frame the feature comes from the company’s own 2025 DevSecOps Report, and the release blog post does not provide a comparable post-deployment number for customers using the agent.
The sources reviewed for this article do not specify how the per-review flat rate of $0.25 maps to credit consumption when reviews are charged against the new caps, or how Vertex AI routing affects per-call costs relative to GitLab’s default inference path. Pricing for Premium and Ultimate seats themselves is unchanged in the materials reviewed.