GitLab 19.2 Uses AI Agents to Handle Security Backlog

GitLab released version 19.2 of its DevSecOps platform on July 16, 2026, adding agentic automation to address the backlog of security and code review work caused by AI coding tools generating code faster than developers can manually check. The release includes four features now GA or in public beta: Dependency Scanning Auto-Remediation, Security Review Flow, GitLab Duo CLI, and Custom Workflows. GitLab positions this as a response to the 'AI paradox' where AI-assisted coding outpaces security and code review. Dependency Scanning Auto-Remediation (public beta) creates merge requests suggesting safe versions for vulnerable dependencies, and retries changes that break builds. Security Review Flow (public beta) detects logic flaws like authorization check failures and race conditions, posting review results as comments without approving merge requests. GitLab Duo CLI (GA) brings agents to the terminal. Custom Workflows (GA) lets teams build workflows using YAML triggered by GitLab events. GitLab also added AI audit event reporting (beta) for compliance and MCP access control. A Forrester study commissioned by GitLab found 400% ROI with Duo agent platform. The update continues GitLab's trajectory toward agentic AI, which began with Duo agent platform beta in August 2025 and GA in January 2026.