CodeRabbit has developed an AI-powered governance and control platform to validate and establish trust in agent-generated code. The company says its platform is used by more than 20,000 organizations and over 150,000 open-source projects to help teams understand, review, secure, and decide what AI-produced code is ready to ship.
Why code reviews become the bottleneck
Harjot Gill, co-founder and CEO of CodeRabbit, explains that when teams adopt coding agents the first bottleneck they encounter is code review: teams must apply judgment to a growing volume of AI-generated changes. Addressing that need is the core use case for CodeRabbit’s platform.
Models and products used
CodeRabbit’s first product was built on GPT‑3.5 Turbo. The arrival of GPT‑4 made automated code review much more effective, and the company later adopted OpenAI o1 and o3 models. Because reviews are run asynchronously in the cloud, CodeRabbit can choose models that take longer to reason but provide deeper analysis.
The company uses Codex to accelerate shipping and Daybreak to test and secure both its own stack and customers’ code. Its newest product, CodeRabbit Secure, combines Daybreak with Codex models and security-focused agents to find and remediate vulnerabilities.
Benchmarks and evolving bug classes
CodeRabbit evaluates new models against its internal benchmark of known issues. At the time of the interview, Harjot estimated that GPT‑6 Astra detected about 50% of the problems in that dataset, ranking it highest among the models they tested. The benchmark is evolving, however, because agents introduce new types of mistakes and fixes can expose problems missed by earlier reviews.
Improved price–performance enables more subagents
Better price–performance from OpenAI models has allowed CodeRabbit to move capabilities from research into product. Lower-cost models like GPT‑6 Luna now support more subagents across the platform, while models such as GPT‑6 Astra handle planning and orchestration. Where the company once used one or two subagents for code navigation, it now runs agents broadly across use cases it previously couldn’t afford. That expansion increases the kinds of validation and developer-facing explanations the platform can deliver.
Shipping ~20× more software with Codex
According to Harjot, using Codex has let the company ship roughly twenty times more software over the past six months without adding engineers. He estimated that in the 30 days before the interview he personally pushed approximately 2,500–3,000 pull requests.
Reaching that scale required more than switching to Codex. Running multiple agents revealed constraints across the development lifecycle — from laptop memory and compute to testing, build and packaging tools, and dependency management. The team streamlined release processes and rethought where human approvals were necessary, while automatically shipping low-risk changes with CodeRabbit when no human intervention was required. "We had to actually completely rethink the entire software delivery," Harjot says.
Beyond engineering: incident triage and company-as-code
CodeRabbit built a Codex-powered Slack bot that triages production incidents, Slack messages, and support tickets, and can return a pull request for the team to review and merge. Harjot views cloud-based development as a way to reduce local-machine constraints and provide stronger access and auditing controls.
The company also applies Codex outside engineering: marketing and operations tasks are managed through code. For Google Ads, for example, they open and merge pull requests to deploy ads. A content studio repository lets Codex produce slide decks and customer-facing documents. Harjot argues that translating marketing problems into code problems can make teams run up to ten times faster.
Security testing, Daybreak, and promotional deep scans
CodeRabbit has been running agents in sandboxed environments since 2023, cloning repositories and letting agents write code to aid reviews. Recently, the company used OpenAI’s Cyber model via Daybreak to perform internal penetration testing and harden its platform. Harjot says early access uncovered multiple vulnerabilities and advanced attack scenarios they had not imagined.
CodeRabbit brought those capabilities to market with CodeRabbit Secure. In a two‑week promotional offer, the company covered $1 million in free deep scans and reported finding over 43,000 security vulnerabilities across 13,000 deep scans, all powered by Codex models. Thousands of those vulnerabilities have already been fixed by customers.
Looking forward: validating and governing agentic development
As background agents increasingly respond to alerts and incidents without a human initiating each task, Harjot expects teams will need more support to decide which changes to accept and ship. CodeRabbit is positioning itself to help teams validate, prioritize, explain, secure, and verify agent-generated code changes at scale.
The broader opportunity is to keep developers in control as agents do more of the building—by providing validation, explanations, and maintenance that match the speed and scale of agent-produced code.
