CodeRabbit uses GPT-6.1 Sol to investigate security risks across code

OpenAI’s October 26 account says CodeRabbit uses GPT-6.1 Sol as its security agent’s primary model. For developers reviewing a proposed code change, it connects behavior across files and components to identify potential weaknesses beyond the edited lines. The review operates independently of the agent that wrote the code. CodeRabbit also uses other models and security tools; Sol is not the entire system.

The scanning documentation describes Deep Scan as investigating committed source code and infrastructure configuration beyond a proposed change. Running it requires Security write access. Its usage is billed separately from the continuous review included in Advanced and Enterprise. It does not analyze third-party software composition or produce a software bill of materials. Completed scans may still have limited coverage. For supported findings, Fix with AI proposes a code change for review without merging it automatically.

Verification starts by rechecking the source before generating reproduction instructions. Those instructions are not evidence that a test ran. Optional execution inside CodeRabbit needs a prepared environment. Verification requires organizational enablement, GitHub Cloud on CodeRabbit Cloud, Security read and repository access, plus available Agent minutes or usage billing. A “not reproduced” result applies only to the tested conditions: it does not rule out the weakness elsewhere.