GPT-6.1 Sol Is Now CodeRabbit's Security Engine — What the $1M Free Scan Offer Actually Gets You

CodeRabbit is covering up to $5,000 of AI security review per organization, and the window shuts at 23:59:59 PST on November 8, 2026. The model it runs that work through is GPT-6.1 Sol, which OpenAI shipped on September 29 — this is not a launch story, and the model's age is the least interesting thing about it. What changed between October 23 and October 26 is narrower and more consequential: a code-review company with real enterprise reach put that model at the center of a security product, published the workflow around it, and attached a deadline to letting strangers try it.

Three documents landed inside four days. CodeRabbit's own blog post on October 24, an OpenAI customer story on October 26, and a Business Wire release the same day announcing both the free-scan commitment and CodeRabbit's entry into OpenAI's Daybreak Defense Network. Read together they describe a deployment pattern worth understanding even if you never buy either product. Read separately, they are marketing. The useful work is separating the two.

What CodeRabbit actually built around GPT-6.1 Sol

The OpenAI case study is specific about placement, which is the part that matters: GPT-6.1 Sol is described as the primary model in CodeRabbit's security agent, working alongside other frontier models and the scanners customers already run. It is not presented as a replacement for static analysis. CodeRabbit's own post goes slightly further, saying CodeRabbit Secure uses "GPT 6.1 Sol and GPT Cyber models" — a stack, not a single call.

The product has three layers, and they are genuinely different jobs:

• PR review — reads each change as it lands, inside the normal review flow.

• Deep Scan — maps the whole repository rather than one diff, tracing how components and dependencies interact.

• CodeRabbit Secure — extends that to linked repositories, so a flaw in a shared auth library shows its blast radius across every service that imports it.

The interesting engineering is at the end of the chain. For findings a user selects, CodeRabbit attempts to verify exploitability by executing against the issue in an isolated sandbox — explicitly not production — and returns one of three states: Reproduced, Not reproduced, or Inconclusive. Only supported findings turn into a proposed fix, delivered as a pull request that a human reviews, tests and merges. The merge gate never moves to the model.

That ordering — reachability first, execution second, patch third — is the reason this deployment is worth reading about. Most "AI finds bugs" products stop at the first step and hand you a list ordered by a language model's confidence. Adding a sandbox converts a claim into a test. Adding a fix PR converts a test into a diff your CI can actually judge.

The free scan offer, in the terms that decide whether you can use it

CodeRabbit's landing page is unusually explicit about the mechanics, which makes the offer easy to evaluate rather than squint at:

• Window — October 23 through November 8, 2026, ending 23:59:59 PST.

• Ceiling — up to $5,000 per organization in Deep Scan usage and fixes.

• Total pool — $1 million, drawn from a shared 1,000,000-credit limit, first come, first served.

• Eligibility — organizations with two or more members. Open-source projects, current customers, former customers and teams that have never touched CodeRabbit all qualify.

• What converts — only supported findings become fixes, so the credit buys investigation and remediation, not a promise that everything found gets patched.

• Unused credit — claimed but unspent credits do not roll over past the deadline or past exhaustion of the shared pool.

That eligibility line is the one to read twice. "Any organization" in the press release means any organization with at least two members, which rules out solo maintainers — a group that runs a large share of the open-source code most companies depend on. If you are one person with a repository, the offer does not apply to you, and no amount of signing up changes that.

The second thing to plan around is the meter. Deep Scan is usage-billed, and cross-repository context is part of what it charges for; linked repositories are read-only, which caps how deep an investigation can go but does not cap what it costs to try. A $5,000 ceiling is generous for a mid-size monorepo and unremarkable for a large one, so the practical move is to point the first scan at the repository you are most afraid of rather than the one that is easiest to hand over.

Why a million-token model is the right shape for repository work

GPT-6.1 Sol's specification explains the fit better than any marketing copy. It carries a 1,050,000-token context window with up to 128,000 tokens of output, accepts text and image input, and supports batch but not fine-tuning. The knowledge cutoff is April 30, 2026. Five reasoning settings ship with it — low, medium, high, xhigh and max — with medium as the default and no "none" or "minimal" option for turning reasoning off entirely.

The pricing is where the shape becomes a strategy. Standard list is $2 per million input tokens and $10 per million output, with cached input at $0.10 and cache writes at $2.50. Requests above 272,000 tokens pay double on input and cache, and one and a half times on output, for the whole request. Batch and Flex run at 50% of Standard; fast mode doubles it; regional endpoints add roughly 10%.

Read those two facts together and the CodeRabbit design stops looking arbitrary. A security agent's cost profile is not a chat cost profile. It reads enormous amounts of mostly-unchanged source, produces comparatively little output, and benefits more than almost any other workload from prompt caching — a repository you scan weekly is a repository whose context barely moves between runs. At $0.10 per million cached input tokens, re-reading a large codebase is cheap in a way that re-reading it at $2 is not. The 272K surcharge threshold is the number to watch: it is roughly a quarter of the window, which means very large scans pay the multiplier on every token in the request, not just the excess.

If you want to price that out against your own repository, GPT-6.1 Sol is on OrcaRouter at list price — pass-through, 0% markup, so the $2/$10 and the $0.10 cached rate are the same numbers OpenAI publishes and move the day OpenAI moves them. That matters more for this workload than for chat: cached input is doing most of the work, and a percentage sitting on top of it compounds across every scan in a series.

OpenAI's published capability numbers for the model, which are vendor-reported and not independently reproduced:

• DeepSWE v1.1 — 75.22% at high effort, at about $0.65 per task.

• Terminal-Bench Science 0.1 — 57.02% at max effort, at about $5.47 per task.

• OSWorld 2.0 — 71.42% at max effort, at about $1.27 per task.

• AutomationBench — 36.10% at max effort; GDP.pdf — 32.0% at high.

• Factual error rate — 7.7% at low effort, against 11.4% for GPT-6 Sol, a reduction OpenAI describes as roughly 32% relative.

One detail in that table deserves more attention than it gets: on DeepSWE, high effort scores 75.22% and max effort scores 71.90%. More reasoning produced a worse result. Anyone who defaults to the top setting on the assumption that it is uniformly better should look at that pair before wiring a security pipeline to max.

The independent number that should temper the pitch

Nine days before the CodeRabbit announcement, Endor Labs published an evaluation that bears directly on the question the case study leaves open. Its Agent Security League ran 200 tasks through Codex CLI 0.144.6 across the GPT-6 family and scored two things: whether the agent completed the task at all, and whether it completed it securely.

GPT-6.1 Sol came in at 77.7% FuncPass and 34.1% SecPass across 179 scored tasks. GPT-6 Astra scored 82.1% and 34.6%. GPT-6 Sol scored 72.1% and 25.1%. Sol's SecPass-to-FuncPass ratio, 43.9%, was the best of the four Codex models tested — meaning it gave up the least correctness when security constraints were applied, even though its absolute security pass rate sits just below Astra's by a single task.

Two-thirds of tasks failing security is the headline, and it is a real finding. It is also not a measurement of vulnerability detection. SecPass asks whether a coding agent wrote working code that was also secure — a different question from whether a security agent finds flaws in code someone else wrote. Reading 34.1% as "GPT-6.1 Sol misses two-thirds of vulnerabilities" would be a category error, and the Endor post does not make that claim. What it does support is a narrower, harder point: on tasks where security and functionality compete, current frontier models trade one for the other more often than vendors imply. A security product built on these models is best understood as an additional reviewer with an unusual reading budget, not an oracle.

Endor's operational numbers are the useful part for anyone costing this out. Median 7.9 minutes per task, mean 13.5, nine timeouts, and a full four-worker run finishing in about 13 hours. Token usage was roughly 235 million input tokens at about 94% cached, with 1.5 million output — an estimated $70 to $85 at list rates, against $104 for GPT-6 Sol and $468 for GPT-6 Astra. Endor also flagged 13 instances of suspected cheating across five signals and cleared all of them, reporting zero confirmed cases.

What the case study does not tell you

OpenAI's customer story contains no false-positive rate, no detection delta against CodeRabbit's pre-Sol configuration, no latency figures and no per-finding cost. CodeRabbit's post doesn't supply them either. Neither is obliged to — a customer story is not an evaluation — but the gap defines how much weight the announcement can carry.

The most-quoted statistic from the release needs the most care. CodeRabbit reports more than 8,000 high- or critical-severity vulnerabilities found across 600 organizations in 30 days, with broken access control, SQL injection and authentication failures accounting for over 70% of them. That is an aggregate for CodeRabbit Secure, not a GPT-6.1 Sol result, and nothing published attributes any portion of it to the model rather than to the scanners and humans around it.

There is also a widely circulated figure that gets misread. Secondary analysis of this deployment cites a 56.3% suggestion rejection rate from a 2026 developer survey — without naming the survey's provider, sample size or method. Rejection is not the same as a false positive: a developer can dismiss a correct finding for being out of scope, badly worded or simply inconvenient. Treat 56.3% as evidence that review noise is expensive, not as a measured false-positive rate, because nobody has published one.

The third caveat is specific to the design. Because the sandbox returns "Inconclusive" as a distinct outcome alongside "Reproduced" and "Not reproduced", a team that triages quickly will learn to skip that bucket. Once skipping becomes habit, alerts get muted in bulk — the same failure mode that made legacy SAST tools easy to ignore. Budget attention for the inconclusive results, or the tool degrades into a compliance checkbox.

None of this argues against running the free scan. It argues for running it as an evaluation with a before-and-after, not as a replacement. CodeRabbit's own framing puts Secure as a complement to existing tooling, and that is the right default: keep Snyk, Semgrep or CodeQL in the pipeline, and measure what the new layer adds on top rather than what it says about itself.

The gate nobody puts in the press release

OpenAI classifies GPT-6.1 Sol as "Critical cybersecurity and High biological/chemical" and routes access through the same safeguard stack as GPT-6 Astra, including Trusted Access and Daybreak. In practice that means cyber-capable use is gated, and gating produces false positives of its own.

There is a documented instance. On October 3, a developer reported in OpenAI's community forum that a read-only, defensive AppSec pull-request review on their own repository was blocked outright as restricted cybersecurity content; the reply from support placed it under Daybreak Blue and Trusted Access for Cyber. That is one user report against an unknown volume of successful requests, not a measurement — but it is the failure mode to plan for. If security review is a production dependency, assume some fraction of legitimate defensive work will be refused, and keep a path that does not route through a gated endpoint.

The Daybreak Defense Network is the other half of that structure. It is OpenAI's partner program for putting frontier cyber models into approved security vendors' products and services rather than directly into customers' hands, with identity verification, scoped testing, logging and human oversight attached. CodeRabbit joining it, and planning to bring OpenAI's dedicated GPT cyber models into CodeRabbit Secure, is a more significant signal than the model substitution itself: it suggests the security-review stack is being split, with a general reasoning model handling breadth and purpose-built cyber models handling the sharp end.

The pattern worth copying even if you skip both products

Strip the branding and what CodeRabbit published is a three-stage loop any team can assemble: give the model repository-wide context including linked dependencies, force suspected findings through execution-based verification in an isolated environment, and emit a reviewable diff for a human to merge. The model is the least proprietary part. The sandbox and the merge gate are what make the output trustworthy, and both are things you control.

That is also the cheapest way to decide whether the free offer is worth your time. Take a repository with a known vulnerability you fixed months ago, run the scan, and see whether it surfaces that issue, how long it takes, and how much of the report you would actually act on. If it finds the planted case and stays quiet otherwise, the $5,000 is worth spending before November 8. If it returns a wall of inconclusive findings, you have learned that for the price of an afternoon.

For teams building the loop themselves rather than buying it, the routing layer is where the operational risk sits. Running an unproven model on a production review path is a bet, and automatic failover is how you take it without losing the pipeline when a provider degrades — the request goes to a fallback model instead of failing the job. The same endpoint serves GPT-6.1 Sol and the models you would fall back to, so comparing them costs a parameter change rather than a second contract and a second SDK.

What to do with the next twelve days

The offer is not a model launch and should not be evaluated as one. GPT-6.1 Sol has been callable since September 29 and its benchmarks have been public since then; nothing about its capabilities changed this week. What changed is that a security vendor with enterprise distribution committed to it publicly, published the verification workflow around it, and put a hard deadline on free access.

If you run a team with two or more members and a codebase you worry about, the arithmetic is simple: a $5,000 ceiling, a first-come pool, and eleven days left after today. Book the scan against your worst repository now, plant a known bug if you want a control, and write down what the report gets wrong as carefully as what it gets right. If you are solo, or if your code is already covered by scanners you trust, the honest answer is that this announcement changes little for you — the model was available before the press release, and it will be available after the credits run out.