CodeRabbit scales agentic software development and ships 20x more

In an OpenAI customer story, CodeRabbit says it uses OpenAI models to review and govern AI-generated code, and that Codex has helped it ship roughly 20 times more software over six months without adding engineers. The platform is used by more than 20,000 organizations and over 150,000 open-source projects. Its new CodeRabbit Secure product uses Daybreak with Codex models to find and fix vulnerabilities, and the company says a two-week promotion covering $1 million in free deep scans turned up more than 43,000 vulnerabilities across 13,000 scans.

The point that resonates with us comes from CEO Harjot Gill: as soon as teams adopt coding agents, the first bottleneck they hit is code review. When machines write more code than humans can read, validation becomes the job.

We think CodeRabbit is pointing at the right problem. Coding agents are useful, and the volume they produce is the reason trust tooling matters. A team that can generate thousands of pull requests needs some way to decide which ones are safe to merge, and human reviewers alone can't keep up. A product that explains changes to developers who didn't write them is solving a real pain.

The architecture is also instructive. CodeRabbit uses a heavier model, GPT-6 Astra, for planning and orchestration, and lower-cost models like GPT-6 Luna to power many subagents. Gill says better pricing and caching let them run agents in places they couldn't previously afford. That mirrors what we're seeing across the industry: cheap execution models are what make multi-agent systems economical.

Now the skepticism. This is a vendor case study published by OpenAI, and the headline figures come from the customer. The 20x number isn't defined; shipping more pull requests isn't the same as shipping more value. Gill estimates he personally pushed 2,500 to 3,000 pull requests in 30 days. That's remarkable throughput, but it also raises the question of how much human judgment can go into each one. The internal benchmark result, GPT-6 Astra catching about half of known issues, is honest and useful, and it also means half are missed.

The 43,000 vulnerability figure needs similar care. We don't know severity, false positive rates or how many were duplicates. CodeRabbit says thousands have been fixed, which is good. But counts of findings are easy to inflate and hard to compare.

The trajectory is what I'm watching. CodeRabbit says it auto-ships low-risk changes without human intervention, manages ads through pull requests, and runs the company as code as much as possible. That's efficient, and in many cases sensible. It also concentrates trust in the review layer. If agents write the code and agents approve it, a blind spot in the reviewer becomes a blind spot in production. The responsible version of this future keeps humans on the high-risk decisions and measures what the machines miss.

CodeRabbit built its first product on GPT-3.5 Turbo and adopted reasoning models early because asynchronous reviews could tolerate slower, more thorough analysis. It used OpenAI's Cyber model through Daybreak for internal penetration testing, and Gill says it found multiple vulnerabilities in its own platform before taking the capability to customers.