GitLab brings Claude Mythos 5.1 into its Business Logic Security Analyzer and offers free-credit security sprints

Background and pain points

Frontier models make finding vulnerabilities faster and cheaper, but remediation has not kept up. Bill Staples cites Verizon's 2026 DBIR: the median time to fully remediate a known-exploited vulnerability rose from 32 days in 2025 to 43 days, and 31% of breaches now start with vulnerability exploitation, the top initial access vector for the first time. Another GitLab post says codebase size across its customers has grown as much as 500% as agents write code. Authorization bugs are a missing line of code, so pattern-matching SAST has nothing to match and misses them most often.

How it works

The Business Logic Security Analyzer is a foundational flow on Duo Agent Platform. It enumerates the application's entry points, maps which records belong to which user and which actions are administrative, then reads each handler to check whether it enforces that rule before touching the record. In GitLab's example, refund_order marks an order refunded using an order_id from the request without checking ownership; taint rules stay silent because the query is parameterized, while the analyzer reports CWE-639 at Critical severity and names the missing ownership check. The model sees only GitLab's prompts and the customer's repository, and findings flow into the same reports, policies and approval gates as other scans.

Benchmarks and numbers

GitLab has not published detection or false-positive rates for the analyzer; the stated goal of early access is to learn with customers where it is right, wrong or silent. The only figures confirmed are GitLab's background data: a 43-day median remediation time (32 days last year), 31% of breaches starting with exploitation, and CVE disclosures through April running 46% above FIRST's February forecast.

Getting started

GitLab.com Ultimate customers can ask their account team for early access, then start a whole-repository scan from Duo Chat or the API, or attach the Business Logic scan profile to a project to scan each merge request. Teams without Ultimate that want to try Mythos can request free credits through the security sprint offer in the blog post. Each scan consumes GitLab Credits in proportion to the attack surface.