GitLab reports rapid growth in agentic software development. Here are four controls businesses need before AI-generated code reaches production.
AI coding agents can produce software faster than many teams can review it. GitLab’s latest announcement shows why businesses now need stronger controls around every generated change.
On 6 October 2026, GitLab announced new tools for what it calls a governed software factory. The company says active users of agentic software development on its platform grew 200% year over year during the last three months. GitLab also reported 40% growth in CI/CD pipelines. These are GitLab’s own platform figures, not an industry-wide measurement.
More code means more packages, credentials, tests and deployment decisions moving through the software pipeline. An AI agent may select an unsafe dependency, expose a secret or create a change that works technically but breaks a business rule.
GitLab’s response includes a Dependency Firewall that can warn, block or quarantine packages based on company policy. Its Secrets Manager limits each build-time secret to the job that needs it and records access in an audit trail. Impact Analytics is designed to connect AI usage and cost with work that reaches production.
Availability differs. Dependency Firewall and Impact Analytics are in early access. Secrets Manager is generally available on GitLab.com, with self-managed availability planned for version 19.5. GitLab Orbit, which provides software-lifecycle context to coding agents, is planned for general availability next month.
Approve trusted packages. Maintain a list of accepted sources, versions and licences. Scan every dependency before it enters a build.
Limit access to secrets. Give each agent and deployment job only the credentials required for its task. Rotate exposed keys quickly.
Require automated proof. Run tests, security scans and policy checks before generated code can merge or deploy.
Keep a clear audit record. Record the request, agent, model, code change, approvals and deployment result. A named person should remain responsible for high-risk actions.
AI coding can reduce delivery time, but faster output increases the cost of weak controls. Start with one low-risk workflow, measure accepted changes rather than generated lines, and expand autonomy only when the evidence shows the process is reliable.
0 comments
Loading comments...