AI-powered vulnerability discovery is shrinking the time between finding software flaws and exploiting them. Frontier models such as Anthropic's
Mythos Preview are uncovering vulnerabilities, working exploits, and attack paths at a pace human security teams cannot match.
For now, Mythos is not available to the general public. Yet it's a matter of months before
AI models with similar capabilities become available first to nation-state actors, and then to cybercriminals.
When that "Mythos moment" arrives, expect a flood of new zero-day
vulnerabilities many times larger than what already-overworked security teams contend with today.
"Whether that really happens with Mythos specifically, or it's another six months to 12 months coming, it is going to come," says GitLab Product Security Leader Jamie Dicken. "The best thing for us to do is to prepare for that reality and prepare for addressing the volumetric changes that come with AI-accelerated offense and focus our response and proactive measures accordingly."
How can organizations get ready? They can soften the battlefield by reducing their
existing exposure, practicing good security hygiene, especially regarding
application security, and, most significantly, getting a head start on finding, validating, prioritizing, and remediating vulnerabilities before attackers do.
One way to speed up this process is by embedding AI agents in the
software development lifecycle (SDLC). But there's a catch: AI agents are most effective when they have context about the environments they're working in.
That's where knowledge graphs enter the picture. By providing AI agents with the thorough context offered by knowledge graphs, organizations can shorten vulnerability-management cycles while maintaining the governance, auditability, and trust necessary for enterprise software development.
Why context in the SDLC grounds agent actions
Defenders and developers already use AI to spot vulnerabilities in first- and third-party software, but that can add to the remediation backlog as legitimate findings mix in with false positives.
"The finding issue is becoming more complicated because alongside legitimate vulnerability discoveries, the number of AI-slop submissions re-skews the whole signal-to-noise ratio," Dicken says. "On top of the fixing problem, now we have a bigger finding problem in figuring out which reports actually matter."
Security teams must validate which services are affected, which pipelines build vulnerable components, and which environments are impacted, as well as which vulnerabilities don't matter. The operational overhead can take far more time than identifying the vulnerability itself.
Embedding AI agents throughout the SDLC automates much of this work. Rather than functioning as assistants, agents can hunt vulnerabilities, manage dependencies, model threats, review merge requests, and plan remediation.
GitLab already uses AI agents internally, Dicken said, to trace dangerous code paths and connect disparate security findings into prioritized remediation efforts.
"We're using them to cut down on false positives and actually understand if vulnerable code is actually reachable," she says.
Speeding up software delivery also shortens exposure windows. Automating dependency updates, improving CI/CD pipelines, streamlining release processes, and reducing deployment friction lets organizations move fixes into production more quickly.
How security teams should approach AI governance and agent auditability
Using AI agents requires strong
governance. Without the right controls, autonomous agents might introduce new risks even as they create new efficiencies.
"Speed without control is chaos," says Dicken. "Agents let you move super-fast, but if you can't govern and see what they're doing, that speed actually works against you."
Proper governance begins with auditability. Organizations should be able to go into their logs to see what an agent accessed, what it did, why it chose the actions it performed, and whether its decisions stayed within approved boundaries.
Human oversight remains an essential safeguard, but it cannot be the only one because users frequently approve AI requests without really scrutinizing what's going on.
"Human-in-the-loop is definitely a critical part, and GitLab helps by giving users agency to determine what things do require human approval, but it's not sufficient on its own," she says. "You need other defenses-in-depth too."
Because of this, governance should layer multiple controls, including authorization-aware access, behavioral monitoring, anomaly detection, and clearly defined guardrails.
The most important adaptation, however, may be a human one: to recognize is that perfect prevention is impossible. Practical governance avoids perfection and instead tries to reduce blast radius, increase attacker friction, and provide enough transparency that AI-assisted decisions can be trusted, reviewed, and improved over time.
Furthermore, says Dicken, security and development teams need to work together more closely, and learn more about the other team's job.
"Security people often think they know what the software development life cycle looks like because they've been trained on it," she says. "[But] there will be additional steps in the build and verification process that they didn't even know existed in the first place."
"The biggest shift is to really start having security teams think and act like engineering teams and build solutions for the volume that's coming," Dicken adds. "When the findings and the noise go up, you can't just keep throwing more manual effort to solve the problem."
How emerging solutions can help build more trustworthy agents
A major obstacle to trustworthy AI is context. Lack of it leads bug-finding AI models to exaggerate or even
hallucinate vulnerabilities if they don't fully understand how software, systems and networks fit together.
Knowledge graphs such as GitLab's Orbit provide that context by mapping repositories, code, dependencies, CI/CD pipelines, and deployment relationships into a connected model that AI agents can query directly.
Instead of forcing an agent to guess how everything fits together, the knowledge graph saves it trouble by giving it an authoritative blueprint of the development environment.
"I view knowledge graphs as kind of like a GPS," says Dicken. "You know where you want to go and you know the steps that you've got to take to get there, and you just end up there right away."
GitLab Orbit was designed specifically to provide this context, says Dicken. By indexing code and development relationships across thousands of projects, Orbit lets AI agents answer complex questions with significantly greater accuracy while reducing hallucinations and token consumption.
"We found that once the knowledge graph was released, the efficacy of even our product security in-house agents skyrocketed because the direct understanding and context at scale was just a massive game changer," Dicken says.
Authorization-aware traversal ensures that agents can only access information appropriate to their assigned tasks or the permissions of the human they represent.
"An agent should only be able to get access to the information that it was either specifically scoped to do," Dicken says. "Or if it's acting on behalf of a user, you can't use it to get more information than what that human user could in the first place."
This enriched information enables AI agents to identify code owners automatically, evaluate blast radius, understand dependency reachability, generate fixes, and prioritize vulnerabilities based on real operational impact rather than isolated scanner output.
With it, security scanners become more useful because their findings are supported by actionable context that speeds remediation rather than creating additional investigative work.
"Knowledge graphs can help with reachability and blast radius so that you can help prioritize," says Dicken. "If you know that something isn't reachable or exploitable, you don't necessarily need to make that a fire drill for your engineering team."
Combined with robust governance, authorization-aware access, and human oversight, knowledge graphs let organizations confidently build software that remains resilient even as AI-powered attackers increase their speed and sophistication. They're an essential part of preparing the SOC for the next battle.
"Just like software engineers can use AI capabilities to increase their velocity and their output, so can security teams," says Dicken. "We can do so in a way that actually helps our software engineers ship with speed and with quality."
