# GitLab 18.10 expands agentic review and security triage > The monthly release opens Duo Agent Platform access to GitLab.com Free groups and makes SAST false-positive assessment generally available. Canonical URL: https://www.devobs.io/news/news-gitlab-18-10-release/ By: Nina Patel Published: 2026-09-06T11:58:54.642Z Updated: 2026-09-06T11:58:54.642Z Event date: 2026-03-19 Section: Developer tools GitLab released version 18.10 on March 19 with changes spanning its Duo Agent Platform, security triage, CI/CD, and package infrastructure. The [official release page](https://about.gitlab.com/whats-new/18-10/) says GitLab.com groups on the Free tier can purchase a shared commitment of GitLab Credits, while SAST false-positive detection through Duo Agent Platform reached general availability for eligible customers. ## AI review moves into ordinary workflow controls GitLab also announced a fixed credit rate for its Code Review Flow and a dashboard that shows which sessions consume credits. For security findings, the platform analyzes newly discovered critical and high-severity SAST results and assigns a false-positive likelihood. GitLab states that users retain the decision to dismiss a finding. That distinction matters: an automated likelihood score is triage input, not evidence that a vulnerability is harmless. Security teams should sample both dismissed and retained findings, track disagreement, and preserve the scanner evidence that informed the original result. ## CI and registry operations gain interfaces Outside AI, 18.10 lets operators provide inputs when running a manual job partway through a pipeline. This can avoid restarting earlier work when a value is known only after another stage, but sensitive inputs still need protection from logs and overly broad job access. The release also adds a beta web interface for container virtual registries, including upstream ordering and cache clearing. Before adoption, administrators should map feature availability to their GitLab deployment and subscription rather than assuming every item applies uniformly. Pilot agentic review on repositories with active human review, set spending and audit expectations, and verify that a generated remediation passes the same tests and approvals as a developer-authored change. The release centralizes more work, but it does not remove the need for independent review. ## Source references -