Code review tools have gotten pretty good at catching the obvious stuff. A SQL injection here, a hardcoded API key there. But most security problems don’t live in the diff. They’re in how the new code interacts with everything else, or in the workflows users actually run.

OpenAI released two case studies this week showing how GPT-6.1 Sol and GPT-6 Astra are changing that. CodeRabbit is using Sol to investigate security risks across entire codebases, not just the files that changed. Greptile is using Astra to test actual user workflows, catching bugs that traditional code review wouldn’t see.

What CodeRabbit is doing

CodeRabbit built what they’re calling a security agent on top of GPT-6.1 Sol. When it finds a potential security issue, it doesn’t just flag the line. It traces how that code connects to the rest of the system, maps out where similar patterns exist, and proposes fixes that account for the broader context.

The difference is Sol’s ability to reason about complex relationships in code. If you introduce a new authentication check in one place, Sol can identify everywhere else that pattern should probably be applied. If you add a new data validation step, it can find similar inputs that aren’t being validated.

This matters because most security vulnerabilities aren’t typos. They’re architectural inconsistencies. One endpoint validates user input, another doesn’t. One function sanitizes SQL parameters, another builds queries with string concatenation. Code review catches these when they’re in the diff. Sol catches them when they’re not.

What Greptile is doing

Greptile took a different approach. They’re using GPT-6 Astra to actually run user workflows and see what breaks. Not just “does the code compile” or “do the unit tests pass,” but “can a user actually complete the signup flow without hitting an error.”

They’re also using something called Daybreak for security (OpenAI hasn’t published details on what Daybreak is yet) and a model called Codex to reduce rework. The Astra piece is the interesting one. Testing full user workflows is expensive and slow when humans do it. Astra can spin up test environments, click through flows, and report what failed.

The technical term for this is “end-to-end testing,” but most teams don’t do nearly enough of it because it’s a pain to set up and maintain. If you can just point an AI agent at your staging environment and say “try to check out as a new user,” that changes the economics.

Why this matters now

GPT-6.1 Sol shipped last week. It’s OpenAI’s reasoning model, the one they’ve been positioning as better at complex, multi-step problems than GPT-6. These case studies are the first real look at what that means in practice.

The pattern is consistent. Sol isn’t just answering questions about code. It’s traversing dependency graphs, tracking state across function calls, and reasoning about how changes ripple through a system. That’s a different capability than “write me a function that does X.”

If you’re using AI coding tools today, they’re probably helping you write faster. Autocomplete on steroids. These tools are trying to help you write more safely, by understanding more of the system than any human can hold in their head at once.

Who should care

If you’re responsible for security at a company with a large codebase, this is worth watching. CodeRabbit’s approach could catch whole classes of vulnerabilities that currently slip through because they’re not in the files being reviewed.

If you’re on a small team and end-to-end testing is something you know you should do but never have time for, Greptile’s approach is interesting. No word yet on pricing or availability for the Astra-powered testing, but the pitch is compelling.

If you’re still trying to figure out what reasoning models are actually good for, this is a concrete answer. They’re good at problems where the solution requires understanding how many pieces fit together, not just what each piece does.

Neither CodeRabbit nor Greptile has published benchmarks showing how many bugs these approaches actually catch compared to traditional methods. OpenAI’s blog posts are case studies, not research papers. But the capability is real, and it’s shipping in production tools now.

GPT-6.1 Sol costs more than the standard models. It’s slower too, because reasoning takes more compute. But for security review and workflow testing, you don’t need instant responses. You need correct ones. That’s the trade-off, and for these use cases, it seems to work.