GPT-6.1 Sol powers CodeRabbit's security agent across complex codebases!
Hi, it's Shii-chan!
OpenAI News
openai.com
CodeRabbit, the AI code review tool, is using GPT-6.1 Sol for security investigation. Let's look!
What was announced?
This is a customer story in OpenAI News. CodeRabbit uses GPT-6.1 Sol as the primary model in its security agent, helping developers understand risks beyond individual code changes.
Why it matters
One pull request can affect shared libraries, dependencies and safeguards elsewhere in an application. The interesting question is whether an AI can follow problems across components that a diff alone would miss.
What changes
- Investigation can take cross-file and cross-component behavior into account, not just the diff
- Validating findings and proposing fixes happens inside the existing pull-request workflow
- CodeRabbit's review is independent of the agent that wrote the code and complements established scanners
Dive Deep
The features mentioned in the article:
- Pull-request review: analyzes changes as developers work
- Deep Scan: broader investigation across repositories, including dependencies and how components interact
- CodeRabbit Secure: extends investigation to linked repositories, such as a shared authentication library, to show how a weakness could affect the wider system
- Remediation: for findings you select, it can attempt exploit verification in an isolated sandbox without testing production systems. For supported issues, it can draft a pull request with a proposed fix for a person to review and approve
CodeRabbit says it uses Sol to flag security issues across "thousands of repositories and organizations." Its system also uses other frontier models and security tooling, and human reviewers decide what ships. The article gives no specific performance numbers.
Wrap-up
- CodeRabbit's security agent uses GPT-6.1 Sol as its primary model
- It investigates risk across repositories, not just single PRs (Deep Scan / Secure)
- It covers sandbox validation and drafted fix PRs
- People still decide what to ship
If your team wants to add a security lens to code review, this story is for you!