Free Deep Scans help engineering teams and open-source maintainers find and fix security flaws before attackers do

CodeRabbit Secure found more than 8,000 serious flaws in one month that point to old, well-known problems hiding in active codebases

CodeRabbit, the governance and control layer for agentic software development, today announced free Deep Scans for any organization. CodeRabbit will cover up to $5,000 in Deep Scan usage per organization, with $1M committed in total, so any engineering team, including open-source maintainers and companies not yet using CodeRabbit, can access CodeRabbit’s advanced security analysis and remediation tools. CodeRabbit is also now part of the OpenAI Daybreak Defense Network and plans to integrate OpenAI GPT cyber models into CodeRabbit Secure.

Deep Scan uses frontier AI models, including OpenAI GPT-6.1 Sol, to reason across an entire codebase, effectively working as a red team to identify vulnerabilities and validate which flaws attackers could reach, so engineering teams get a focused, prioritized list of what to fix. CodeRabbit can also generate suggested fixes that are grounded in the existing standards of each codebase, reducing the burden of remediation.

Over the last 30 days, CodeRabbit Secure found more than 8,000 high- or critical-severity vulnerabilities across 600 organizations. Broken access control, SQL injection and authentication failures accounted for more than 70% of them.

As the shared foundation that nearly all modern software is built on, open-source software is facing a surge of vulnerabilities that most projects aren’t staffed to handle. In the past week alone, PHP, the open-source language behind much of the web, shipped emergency fixes for two critical flaws that had sat in its code for 14 years, and Cloudflare saw exploit attempts climb into the millions within hours. Node.js shipped its own security fixes the same day. Microsoft reported a state-aligned group using an AI hacking tool to target more than 2,250 cloud tenants. And a compromised release of a popular open-source AI library was caught stealing developers’ credentials. Finding flaws is now outpacing the ability of developers to fix them. AI-driven problems need AI-driven defenses.

“AI made writing software abundant, but it broke our process to validate and trust it,” said Harjot Gill, co-founder and CEO of CodeRabbit. “Agents write more code than humans can review, opening up new vulnerabilities. And anyone with a credit card can now exploit them at scale. The attacks over the past week demonstrate that ensuring the security of code is now an urgent task for every engineering team. AI will find the exploit. CodeRabbit is here to help you find it first.”

Security is everyone’s responsibility

AI coding agents now write code faster than anyone can read it. In a June 2026 New Relic survey, 62% of tech leaders said their teams often ship AI-generated code to production without line-by-line review. That leaves flaws nobody has seen, and attackers are using AI agents to find them first. Attackers are also using the latest models to find flaws in older code that has lain dormant for years. As recent flaws in PHP and GitLab showed, code untouched for more than a decade is now vulnerable to exploits discovered using agentic methods.

CodeRabbit Secure takes a new approach to code security, leveraging an agentic harness that uses frontier AI models to identify weaknesses across an entire codebase. Most security tools match code against a fixed set of rules and known bad patterns. CodeRabbit Secure uses multiple AI agents purpose-built for security that look for flaws and exploits in a codebase the way an attacker would. CodeRabbit maps out a codebase in detail, hunts for vulnerabilities in swarms across code paths, examines the safeguards in place, and uses semantic analysis to assess whether a flaw can be exploited. That means it can catch flaws most existing tools miss.

CodeRabbit Secure supports total codebase security before, during, and after the merge. With pull request volume exploding, every change can ripple into code downstream, and a flaw in one change can spread across everything it touches. CodeRabbit performs active review as developers work, including working in adversarial loops with coding agents. CodeRabbit Secure also checks every pull request for security vulnerabilities before it merges, prioritizes PRs for potential human review based on risk, and shows engineering leaders the blast radius of each change so they understand what it could affect before it ships.

When vulnerabilities are identified, CodeRabbit can draft a fix grounded in an engineering team’s existing coding standards and validate whether the vulnerability has been eliminated after the fix is deployed.

“Defenders need to find and fix vulnerabilities faster than attackers can exploit them,” said McCall McIntyre, Head of Global Cyber Partnerships, OpenAI. “Through the Daybreak Defense Network, we’re partnering with CodeRabbit to bring OpenAI GPT cyber models to Deep Scan, helping engineering teams find the flaws attackers could reach and fix them sooner. Making that available free to engineering teams and open-source maintainers helps strengthen the software we all depend on.”

Run a free security Deep Scan today

Any company or open-source project can access free Deep Scans. CodeRabbit Secure is available now on CodeRabbit’s Advanced and Enterprise plans, including the 14-day Advanced trial.

About CodeRabbit

Headquartered in San Francisco, CodeRabbit is the governance and control layer for agentic software development, enabling teams of every size to trust the code they ship while moving at agentic speed. As AI creates code faster than teams can review and understand it, CodeRabbit provides independent validation grounded in codebase context and team standards. It challenges changes before merge, ranks pull requests by value, impact and risk, explains what changes mean, and continuously monitors the codebase for security vulnerabilities after merge. More than 150,000 open-source projects and 20,000 customers worldwide, including Adyen, BMW, Indeed, JFrog, NVIDIA and Trivago, use CodeRabbit to ship more software, faster, without sacrificing quality or disrupting their flow. For more information, visit www.coderabbit.ai.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261026814225/en/