Code review catches obvious bugs. It’s less good at finding the security flaw hiding three layers deep in code nobody touched this sprint.

OpenAI released a pair of case studies this week showing how CodeRabbit and Greptile use GPT-6.1 Sol to investigate security issues across entire codebases, not just the diff in your latest PR. The approach trades the focused attention of traditional code review for something closer to a security audit that runs on every commit.

How it works

CodeRabbit’s security agent uses GPT-6.1 Sol to trace potential vulnerabilities through the call graph. When it flags an issue, it doesn’t just point at the problematic line. It shows you how the vulnerable code path connects to other parts of the system, proposes fixes, and lets developers review the analysis before anything ships.

That last part matters. These aren’t automated fixes applied blindly. The agent surfaces its reasoning so you can decide whether the risk is real.

Greptile takes a different angle with the same model. Its tool uses GPT-6 Astra to test actual user workflows, GPT-6 Daybreak for security analysis, and Codex to reduce the rework that happens when security fixes break functionality. The goal is catching issues before they reach production without creating more work than they prevent.

What this means for security

Traditional static analysis tools excel at pattern matching. They’re fast, deterministic, and they catch the same classes of bugs every time. But they struggle with context. A function that’s perfectly safe in one context becomes a vulnerability when called from somewhere else.

GPT-6.1 Sol’s advantage is understanding that context. It can follow data flow across files, reason about how different components interact, and spot issues that only emerge when you look at the system as a whole.

The tradeoff is cost and latency. Running a security agent on every commit is expensive compared to linting. Whether that’s worth it depends on what you’re building. For a payment processor or a tool handling sensitive data, comprehensive security analysis probably pays for itself. For a marketing site, probably not.

OpenAI’s other Codex announcement

The same day, OpenAI published a case study showing how its own engineers use Codex Ultrafast to investigate incidents. The claim is that incident investigation dropped from hours to minutes.

The pattern here is consistent: GPT-6.1 and Codex models handling tasks that require reading and understanding large amounts of code quickly. Incident response, security audits, and refactoring all involve the same basic operation. You need to figure out what the code actually does before you can fix it.

That’s different from code generation, where you start with a blank file and a specification. These tools aren’t writing new features. They’re helping developers navigate complexity in existing systems.

The webframe wildcard

Unrelated to the OpenAI announcements but worth noting: Jeff Lindsay released webframe, a tool that runs web pages like programs. Point it at a URL or HTML file, and it executes the page in a headless browser, routing console.log() to stdout and exceptions to stderr.

It’s built on top of system browsers (WKWebKit on macOS, WebKitGTK on Linux, WebView2 on Windows), so it doesn’t bundle a browser engine. That keeps it lightweight.

The use case isn’t obvious at first glance, but Simon Willison’s testing suggests it works well for scraping pages that require JavaScript and for running untrusted code in a sandboxed environment. It’s early, but it’s the kind of tool that fills a gap you didn’t realize existed until someone builds it.

Also this week

Microsoft shipped improved PostgreSQL support for VS Code. You can now build, query, and troubleshoot Postgres databases without leaving the editor. The tooling handles connection management, query execution, and basic troubleshooting. It’s not replacing dedicated database clients for complex work, but for routine tasks it’s faster than context switching.

Cloudflare disclosed and patched a KV cache exposure issue in the GLM-5.3 Workers AI model. The vulnerability allowed cross-request cache leakage, meaning one user’s data could potentially leak into another user’s response. The issue is fixed, but it’s a reminder that running inference at scale introduces infrastructure risks that don’t exist when you’re running models locally.