OpenAI says CodeRabbit uses GPT-6.1 Sol as the primary model in its security agent alongside other frontier models and security tools. Ordinary pull-request review is only the first layer. Deep Scan examines dependencies and interactions across a repository; CodeRabbit Secure can extend the investigation to linked repositories such as a shared authentication library.
The security review is independent of the agent that wrote the code and complements established scanners. For a user-selected finding, the system can attempt exploit verification in an isolated sandbox without testing production. For supported findings it can draft a pull request with a proposed fix, but a human decides whether to approve and ship it.
The post says findings span thousands of repositories and organizations, but it publishes no detection rate, false-positive rate, severity distribution, exploit-success rate or comparative benchmark. The evidence supports a broader review boundary—not a claim that scanners, reviewers or release controls can be removed. OpenAI.