CodeRabbit puts GPT-6.1 Sol at the center of its security agent

OpenAI published a customer story on October 26 describing how CodeRabbit, a code-review platform, uses GPT-6.1 Sol as the primary model inside its security agent. The stated goal is not to replace conventional scanners but to widen review from an individual change to the wider codebase it touches.

The underlying problem is connective tissue. A single pull request can affect shared libraries, dependencies and safeguards elsewhere in an application, and a diff alone rarely shows that blast radius. Sol is used to link behavior across files and components so potential security issues surface before merge.

The capability is layered. During pull-request review the model analyzes changes as developers work; Deep Scan pushes the investigation across repositories, including dependencies and how components interact; CodeRabbit Secure extends it to linked repositories such as a shared authentication library, so teams can see how one weakness could travel through the wider system.

Remediation is where the workflow closes. For findings a user selects, CodeRabbit can attempt exploit verification inside an isolated sandbox without testing production systems, and for supported issue types it can draft a pull request with a proposed fix that a person reviews and approves.

OpenAI says CodeRabbit has used Sol to flag security-related issues across thousands of repositories and organizations, with findings routed into the pull-request workflows developers already use. CodeRabbit's system also draws on other frontier models and security tooling, and its review runs independently of the agent that wrote the code.

The interesting claim is not that a model can read a diff, but that it can follow a weakness from one repository into the shared library another team depends on. That is the gap static analysis has long struggled with, and it is where agentic review is being positioned as a complement rather than a replacement.

OpenAI's write-up is a customer narrative, not an independent evaluation. False-positive rates, how often sandbox exploit verification actually succeeds, and the cost of running this across very large monorepos are all undisclosed.

Watch for reproducible benchmarks from CodeRabbit, whether in-sandbox exploit validation becomes table stakes for code security products, and whether per-repository pricing holds up with enterprise buyers.