Building AI Security Through Open Collaboration
GitLab joins the Open Secure AI Alliance to prioritize transparency and trust in agentic software development.
1Trust in the AI Era
GitLab CEO Bill Staples argues that as AI reduces software production costs, trust becomes the primary scarcity. The challenge involves verifying not just the generated code, but the agents creating it. Security and collaboration are now essential pillars for maintaining integrity in automated development workflows across all enterprise software production environments.
2Joining the Open Alliance
GitLab has officially joined the Open Secure AI Alliance to foster community-driven security standards. This partnership focuses on developing shared technologies and techniques to safeguard software agents. By participating, GitLab aims to ensure that AI security remains a collective effort, allowing defenders to inspect, test, and improve systems through open collaboration.
3Transparency via AI Gateway
The GitLab AI Gateway functions as a standalone service supporting GitLab.com, Dedicated, and self-managed instances. Its source code and agent workflow configurations are entirely public. This transparency extends to critical processes like code creation, review, and secrets detection, enabling users to audit the logic governing their AI-assisted development pipelines and security reviews.
4Beyond the Model Layer
An AI system's security depends on more than just the underlying model. GitLab emphasizes the importance of the surrounding harness, workflows, and evaluation controls. Open tooling allows security teams to understand these components, test them against specific real-world risks, and iterate on defenses more effectively than with closed, proprietary black-box systems.
5Enterprise Flexibility and Choice
Enterprises require the freedom to choose between proprietary and open-weight models based on their specific operational needs. GitLab promotes model and cloud agnosticism to preserve this flexibility. By supporting an open ecosystem, they provide customers with more options for governing and securing AI systems without being locked into a single vendor's architecture.
6Managing Agentic System Risks
GitLab publishes documentation detailing specific attack paths and controls for their agentic systems. They treat these agents as privileged actors, requiring explicit identities and constrained permissions. Every action performed by an agent is subject to audit, ensuring that security teams can monitor and restrict tool usage within complex, automated development environments.
7Technical Security Mechanisms
The company implements specific security measures including composite identity, sandboxed execution, and per-flow tool restrictions. These mechanisms ensure that agents operate within strictly defined boundaries. By sharing these configurations, GitLab provides a blueprint for other organizations to implement similar governance models, reducing the potential for unauthorized actions or system exploitation.
8Future of Secure AI
The goal is not to position open-weight models against closed ones, but to provide defenders with necessary transparency and control. Building AI security in the open allows for a more resilient ecosystem. As agentic systems become more prevalent, this collaborative approach will be essential for building trustworthy software in the modern age.
Original article: GitLab — Building AI Security Through Open Collaboration