# Building AI Security Through Open Collaboration GitLab joins the Open Secure AI Alliance to prioritize transparency and trust in agentic software development. - **Source:** [GitLab](https://brifing.si/source/76101668-80db-4240-8676-e968d2b72546) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8b8803b2-6792-4c53-b893-c47cd63929f9 ## Trust in the AI Era GitLab CEO Bill Staples argues that as AI reduces software production costs, trust becomes the primary scarcity. The challenge involves verifying not just the generated code, but the agents creating it. Security and collaboration are now essential pillars for maintaining integrity in automated development workflows across all enterprise software production environments. ## Joining the Open Alliance GitLab has officially joined the Open Secure AI Alliance to foster community-driven security standards. This partnership focuses on developing shared technologies and techniques to safeguard software agents. By participating, GitLab aims to ensure that AI security remains a collective effort, allowing defenders to inspect, test, and improve systems through open collaboration. ## Transparency via AI Gateway The GitLab AI Gateway functions as a standalone service supporting GitLab.com, Dedicated, and self-managed instances. Its source code and agent workflow configurations are entirely public. This transparency extends to critical processes like code creation, review, and secrets detection, enabling users to audit the logic governing their AI-assisted development pipelines and security reviews. ## Beyond the Model Layer An AI system's security depends on more than just the underlying model. GitLab emphasizes the importance of the surrounding harness, workflows, and evaluation controls. Open tooling allows security teams to understand these components, test them against specific real-world risks, and iterate on defenses more effectively than with closed, proprietary black-box systems. ## Enterprise Flexibility and Choice Enterprises require the freedom to choose between proprietary and open-weight models based on their specific operational needs. GitLab promotes model and cloud agnosticism to preserve this flexibility. By supporting an open ecosystem, they provide customers with more options for governing and securing AI systems without being locked into a single vendor's architecture. ## Managing Agentic System Risks GitLab publishes documentation detailing specific attack paths and controls for their agentic systems. They treat these agents as privileged actors, requiring explicit identities and constrained permissions. Every action performed by an agent is subject to audit, ensuring that security teams can monitor and restrict tool usage within complex, automated development environments. ## Technical Security Mechanisms The company implements specific security measures including composite identity, sandboxed execution, and per-flow tool restrictions. These mechanisms ensure that agents operate within strictly defined boundaries. By sharing these configurations, GitLab provides a blueprint for other organizations to implement similar governance models, reducing the potential for unauthorized actions or system exploitation. ## Future of Secure AI The goal is not to position open-weight models against closed ones, but to provide defenders with necessary transparency and control. Building AI security in the open allows for a more resilient ecosystem. As agentic systems become more prevalent, this collaborative approach will be essential for building trustworthy software in the modern age. ## Sources covering this story - https://about.gitlab.com/blog/gitlab-joins-open-secure-ai-alliance/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._