AI agents in DevSecOps: from code generators to security backlog killers
AI agents in DevSecOps are specialised automation tools that not only generate code but also perform structured security review and remediation steps, rapidly processing vulnerabilities, logic flaws, and dependency risks so that human maintainers can focus their limited review time on approving or rejecting well-prepared changes instead of doing repetitive patching work by hand. The uncomfortable truth is that AI coding tools have broken the balance between output and oversight. Coding agents can flood repositories with changes faster than teams can safely review, test, and validate them, turning security into a permanent bottleneck. If we keep adding generators without adding reviewers, risk concentrates in the queues that nobody has time to clear.
GitLab 19.2: agentic automation aimed squarely at the AI security backlog
The latest GitLab DevSecOps release takes a clear stance: security review needs its own AI agents, not more dashboards. Version 19.2 adds agentic automation designed for the security and review work that has piled up as AI coding tools generate more code than developers can check manually. Dependency Scanning Auto-Remediation now opens merge requests when scans find vulnerable dependencies, proposes safe versions, and iterates until the pipeline passes, even when roughly one in eight dependency updates introduces a breaking change of its own. A companion Security Review Flow targets logic flaws such as broken authorisation checks, mass assignment, and race conditions—the kind of bugs pattern-matching scanners often miss. Crucially, maintainers still have to review and approve every change before it merges, so the automation tackles the code generation backlog without removing human checkpoints. That is the right boundary: agents do the grunt work, humans own the decision.
When one developer reviews 50 agentic pull requests alone
The review bottleneck is most visible where teams are smallest. A study of 25,264 agentic pull requests on GitHub found that 78.9% were reviewed and committed by a single developer, who reads the agent’s code, fixes what needs fixing, and merges it. Repositories with one to five contributors averaged 50.2 agentic pull requests apiece in a three‑month window, far above what medium and large teams managed. In practice, the median repository only opens one or two such pull requests per quarter, but heavy users are tiny teams with one reviewer bearing the entire load. Code review already consumes a large slice of the workweek, and every agentic pull request still has to be read, tested, and judged worth merging. This is where AI agents for security review matter most: they compress the manual work around each change so that solo maintainers are less likely to wave exhausted reviews through.
Frontier data agents show what specialised security automation should look like
General coding agents are not the gold standard for accuracy or cost, and that matters when we point them at security work. In an evaluation of 401 real data tasks, the frontier data agent Genie Code delivered 76.6% accuracy at an estimated USD 0.55 (approx. RM2.55) per task, while a leading general-purpose Agent X reached 72.1% at about USD 1.09 (approx. RM5.05) per task. The common belief that better answers always cost more tokens did not hold: Genie Code was both the most accurate and the cheapest agent in the benchmark. It achieved this by using semantic search over catalogs and workspace assets, persistent memory of tables and business logic, and deep semantic understanding of enterprise context, instead of wandering through random tool calls. Security-focused AI agents should follow the same pattern: tight domain awareness, explicit context, and efficient tool use, not blind exploration.
AI agents security review: closing the gap without removing human judgment
The core DevSecOps automation story is no longer about scanning; it is about clearing a code generation backlog that human reviewers cannot keep up with. GitLab’s agentic automation tools show how to do this without handing control to machines: agents open and iterate on remediation merge requests, comment on subtle logic flaws, and run in custom flows triggered by platform events, while new audit event reports and access controls record their activity and restrict what they can reach. Genie Code’s performance proves that specialised agents can outperform general coding tools in both accuracy and cost, which should encourage teams to deploy security-specific agents instead of repurposing whatever coding bot they already use. The conclusion is blunt: AI will keep generating more code than humans can review, so teams that care about safety need AI agents for security review to absorb the overflow while keeping humans firmly in charge of what ships.
