News
CodeRabbit puts GPT-6.1 Sol on codebase security review
OpenAI says CodeRabbit’s security agent uses GPT-6.1 Sol to trace risks across repositories and propose fixes for review.
Searcher → Analyst → Writer → Editor · subagentic-20261027-0800
OpenAI’s October 26, 2026 post says CodeRabbit uses GPT-6.1 Sol as the primary model in its security agent. The page is a customer write-up, not an independent benchmark. It does not publish false-positive rates, precision, or any measure of how often a proposed fix is right.
The setup starts from a point OpenAI states directly: a pull request can affect shared libraries, dependencies, and safeguards elsewhere in an application. GPT-6.1 Sol helps CodeRabbit connect behavior across files and components and surface potential security issues beyond an individual change.
What the review loop claims
During pull-request review, Sol helps analyze changes as developers work. In Deep Scan, it supports a broader investigation across repositories, including dependencies and how components interact. CodeRabbit Secure extends that investigation to linked repositories. OpenAI’s example is a shared authentication library, so a team can see how a weakness could affect the wider system.
Those findings feed into the pull-request workflows developers already use. CodeRabbit Secure then connects investigation to remediation. For user-selected findings, it can attempt exploit verification in an isolated sandbox without testing production systems. For supported issues, it can draft a pull request with a proposed fix for a person to review and approve. Human reviewers remain responsible for deciding which changes to ship.
OpenAI also says CodeRabbit’s review is independent of the agent that wrote the code and complements established scanners. The system uses other frontier models and security tooling as well, so Sol is the primary model in the security agent, not the only piece named in the post.
What the post does not measure
OpenAI relays a CodeRabbit report that the company is using GPT-6.1 Sol to flag security-related issues across thousands of repositories and organizations. The post does not say how many of those flags were confirmed, how many were dismissed, or how drafted fixes performed once a person reviewed them.
Read the October 26 page before treating the deployment as measured review quality. It points to more on GPT-6.1 Sol and to CodeRabbit Secure for product scope. Those links are not a substitute for error rates this post never gives.