According to an OpenAI announcement dated October 26, 2026, the code-review company CodeRabbit is using GPT-6.1 Sol as the primary model in its security agent. OpenAI states the model helps CodeRabbit extend review beyond individual code changes to connect behavior across files, dependencies and components, surfacing potential security issues across complex codebases.
Per the announcement, the model is applied in several ways: during pull-request review it analyzes changes as developers work; in a feature called Deep Scan it supports broader investigation across repositories, including dependencies; and CodeRabbit Secure extends investigation to linked repositories, such as a shared authentication library. OpenAI says CodeRabbit's review is independent of the agent that wrote the code and complements established scanners, and that its system also uses other frontier models and security tooling.
OpenAI reports that CodeRabbit uses GPT-6.1 Sol to flag security-related issues across thousands of repositories and organizations. For user-selected findings, CodeRabbit Secure can attempt exploit verification in an isolated sandbox without testing production systems, and for supported issues it can draft a pull request with a proposed fix. The announcement states that human reviewers remain responsible for deciding which changes to ship. The figures and claims come from OpenAI, the vendor announcing its own partnership.
- CodeRabbit is using GPT-6.1 Sol as the primary model in its security agent (OpenAI, Oct 26, 2026)
- CodeRabbit Secure can attempt exploit verification in an isolated sandbox and draft fix pull requests for human approval
- OpenAI reports the model flags security issues across thousands of repositories and organizations
- CodeRabbit's review is described as independent of the agent that wrote the code and complements existing scanners
What it means for you
If your team ships software, this is one more AI tool promising to catch security problems across a whole codebase rather than one change at a time — and importantly, the vendor says a human still approves every fix. It's a product update from a specific tool (CodeRabbit), not a shift that forces anyone's hand. Treat the 'thousands of repositories' and other numbers as the vendor's own claims, not independently verified results.
Try this
If you already use CodeRabbit or an automated code reviewer, ask your engineering lead one question this week: when the tool proposes a security fix, who reviews and approves it before it merges, and is that step actually enforced? Map that handoff before considering any new capability.
Who should care
Engineering leads and application-security teams who already run automated code review, and whoever owns your software release process.
Skip this if
You don't build software in-house, or you don't use CodeRabbit and aren't evaluating code-review tooling right now.
Sources: OpenAI — read the original