CodeRabbit uses GPT-6.1 Sol as main model in its security agent
CodeRabbit is using OpenAI's GPT-6.1 Sol as the primary model in its security agent, aiming to look beyond single code changes and surface risks across complex codebases, according to OpenAI. Human reviewers still decide what ships.
- CodeRabbit uses GPT-6.1 Sol as the primary model in its security agent.
- Sol helps trace risks across files, dependencies and linked repositories, such as a shared authentication library.
- CodeRabbit reports flagging security-related issues across thousands of repositories and organizations.
- CodeRabbit Secure can attempt exploit verification in an isolated sandbox for user-selected findings and draft fix pull requests.
- Human reviewers remain responsible for deciding which changes to ship.
Looking beyond a single pull request
According to OpenAI, AI is speeding up software development, and engineering and application-security teams need ways to investigate code changes and address vulnerabilities while keeping people in control. A single pull request can affect shared libraries, dependencies and safeguards elsewhere in an application, so reviewing only the changed lines can miss problems.
GPT-6.1 Sol helps CodeRabbit connect behavior across files and components to surface potential security issues. OpenAI says CodeRabbit's review is independent of the agent that wrote the code and complements established scanners. The system also uses other frontier models and security tooling, so Sol is the primary model but not the only component.
Pull-request review, Deep Scan and CodeRabbit Secure
The model is used at several levels of CodeRabbit's product:
- Pull-request review: Sol helps analyze changes as developers work.
- Deep Scan: it supports broader investigation across repositories, including dependencies and how components interact.
- CodeRabbit Secure: it extends that investigation to linked repositories, such as a shared authentication library, to help teams understand how a weakness could affect the wider system.
CodeRabbit reports using GPT-6.1 Sol to flag security-related issues across thousands of repositories and organizations. According to OpenAI, these findings feed into the pull-request workflows developers already use to review and improve their code.
From investigation to proposed fixes
CodeRabbit Secure connects investigation to remediation. For findings selected by the user, it can attempt exploit verification in an isolated sandbox, without testing production systems. For supported issues, it can draft a pull request with a proposed fix for a person to review and approve.
OpenAI describes the work as an example of how frontier reasoning can support software security: understanding risks beyond an individual change, helping validate findings and turning them into proposed fixes.
What it means for development teams
For teams adopting AI to write code, the announcement points to a review layer that is separate from the coding agent and that follows risks across repositories rather than stopping at the diff. The source stresses that the process stays under human control: exploit checks run only on user-selected findings, fixes are drafts, and, in OpenAI's words, "Human reviewers remain responsible for deciding which changes to ship."
The source gives no pricing, availability details or performance figures, so how the approach compares with other tools is not addressed.
