GitLab brings Claude Mythos 5.1 into its Business Logic Security Analyzer and offers free-credit security sprints
On Oct 28, GitLab CEO Bill Staples announced in a blog post and on X that new and existing customers can request free credits to run a security sprint with Claude Mythos alongside GitLab Orbit, Secrets Manager and Duo Agent Platform. The core capability is the Business Logic Security Analyzer, the first GitLab feature to support Anthropic's Claude Mythos 5.1. It reads the whole repository, infers what each endpoint should enforce, and flags authorization and mass-assignment flaws that pattern-based SAST misses. The analyzer has been in early access for a small group of GitLab.com Ultimate customers since Oct 20.
Key Takeaways
- The Business Logic Security Analyzer is the first GitLab feature to support Claude Mythos 5.1; it also supports Claude Opus 5.5, Sonnet 5.5, Sonnet 5 and Sonnet 4.6, all as GitLab-managed models via GitLab's AI gateway
- It starts with three flaw classes: broken object-level authorization (BOLA), missing or improper authorization, and mass assignment
- Scans can run on the whole repository from Duo Chat or the API, or automatically on each merge request after its pipeline passes; findings land in the Vulnerability Report and MR security widget as SAST results
- Early access is limited to a small group of GitLab.com Ultimate customers; each scan consumes GitLab Credits, with cost scaling with the application's attack surface
- New on Oct 28: a security sprint offer where qualifying teams can request free credits for Ultimate, Duo Agent Platform, Orbit and Secrets Manager
Linked Models & Agents:
