CodeRabbit expands codebase security reviews with GPT-6.1 Sol
CodeRabbit has made OpenAI’s GPT-6.1 Sol the primary model in its security agent, aiming to extend software-security review beyond an individual pull request. The company says the model is helping flag security-related issues across thousands of repositories and organizations, while findings are delivered through the pull-request workflows developers already use.
The deployment addresses a practical problem in application security: a change in one pull request can affect shared libraries, dependencies and safeguards elsewhere in an application. CodeRabbit uses GPT-6.1 Sol to connect behaviour across files and components so that teams can investigate potential risks in a broader codebase context.
Review beyond the changed lines
During pull-request review, Sol analyses changes while developers are working. CodeRabbit describes this review as independent from the agent that wrote the code, and says it complements established scanners rather than replacing them. Its system also uses other frontier models and security tooling.
This distinction matters because conventional automated checks and code review can focus on a particular change or predefined class of issue. CodeRabbit’s stated goal is to help developers understand how a modification may interact with software outside the immediate diff, including dependencies and shared components.
Deep Scan and linked repositories
CodeRabbit’s Deep Scan uses Sol for a wider investigation across repositories, examining dependencies and the ways components interact. The company’s CodeRabbit Secure offering takes the same approach into linked repositories. A shared authentication library is one example cited by CodeRabbit, where a weakness may have consequences beyond the repository in which it was first identified.
That wider investigation is intended to give engineering and application-security teams more context for assessing a finding. It also reflects the fact that codebases are rarely isolated: shared libraries and connected services can carry the effect of a defect across a larger system.
Verification and proposed remediation
CodeRabbit Secure connects investigation with remediation for findings selected by users. It can attempt exploit verification in an isolated sandbox, rather than testing production systems. For supported issues, it can also draft a pull request containing a proposed fix.
The proposed change is not an automatic release decision. A person reviews and approves it, and human reviewers remain responsible for choosing which changes to ship. OpenAI presents the work as an example of frontier reasoning being used to investigate risks beyond one code change, validate findings and turn them into candidate fixes.
For businesses, the practical implication is to treat AI-assisted security review as an addition to established scanning and human approval processes: it can broaden investigation across connected code, but release accountability remains with the team that reviews the result.