CodeRabbit Release Notes

Triage

Triage is CodeRabbit's reviewer-first prioritization layer for agent-generated pull requests. It gives reviewers, maintainers, code owners, and team leads a self-updating, cross-repository queue that answers: which pull request to review next, how deeply to review it, and which pull requests can be closed.

Built-in views separate work you authored, reviews that need you, the full organization queue, and pull requests recommended for closure. From the queue, eligible users can open a pull request in Change Stack, start a CodeRabbit review, repair conflicts or failing CI where supported, manage reviewers and make a user-controlled closure decision.

Try it at app.coderabbit.ai/triage, or see the Triage documentation for details.

Organization inventory API

Enterprise teams can now discover CodeRabbit organizations and their active repositories through the public API. Use GET /v1/organizations to retrieve the CodeRabbit organization UUIDs available to the current organization or workspace key, then pass an ID to GET /v1/organizations/{organization_id}/repositories to list that organization's active repositories.

See List organizations and List organization repositories for authentication requirements, pagination, and response schemas.

The most dangerous line of code you'll ship probably looks harmless on its own. The risk only becomes clear when you see how it interacts with the rest of the application. Catching it means security review has to trace those connections across the entire repository.

CodeRabbit Security does exactly that, hunting application-specific vulnerabilities across the codebase, showing the evidence behind each one, and moving supported findings into remediation without leaving the development workflow.

AI is shrinking the defender’s window

AI is increasing both the volume of code that needs scrutiny and the speed at which attackers can investigate it. In New Relic’s 2026 State of AI Coding report, 67% of surveyed technology leaders said AI generated or significantly refactored between 51% and 75% of their organizations’ weekly code output. Veracode's Spring 2026 testing gave models 80 coding tasks spanning four languages and four vulnerability categories, with no security-specific guidance. Only 55% produced secure code, and in the other 45% the model introduced a known security flaw.

Attackers are gaining the same leverage. In November 2025, Anthropic reported that a group it assessed with high confidence to be Chinese state-sponsored manipulated Claude Code into attempting to infiltrate roughly 30 organizations in a cyberespionage campaign. According to Anthropic, AI performed 80% to 90% of the campaign’s work, while human operators intervened at perhaps four to six critical decision points per hacking campaign.

Coding agents have become part of the attack surface as well. In June 2026, Tenet Security described an attack it calls agentjacking, in which instructions hidden inside fake Sentry error reports caused coding agents to perform attacker-directed actions. Tenet reported that more than 100 agents acted on injected errors during controlled validation, including Claude Code, Cursor, and Codex, with an 85% exploitation success rate against the injected errors.

We recently explored the broader threat shift in “You can’t fix what you can’t detect and understand.”

The vulnerability can be the check that never happens

Static analysis is highly effective when a vulnerability can be identified through a known rule or data-flow pattern. It can catch hardcoded secrets, vulnerable dependencies, and many common injection paths.

Other vulnerabilities depend on application-specific behavior. The relevant code may span routes, services, authorization logic, and data models, with no single line appearing unsafe on its own.

Consider this simplified request path:

An authenticated order route passes an order ID through a controller to a database lookup without checking whether the caller owns the order.

A scanner focused on known rules and data-flow patterns may see several reassuring signals here. The route requires authentication, the database query is parameterized, and user input never reaches an obvious injection sink.

But the vulnerability lies in the check the application never performs.

requireAuth proves the caller is logged in. Nothing along the request path establishes that the caller owns order :id or has permission to view it, so any authenticated user able to enumerate order identifiers can retrieve another customer's order.

Detecting this insecure direct object reference requires application-level reasoning. CodeRabbit Security distinguishes authentication from authorization, examines the schema and surrounding code for ownership relationships, and traces req.params.id from the attacker-controlled entry point through the controller to the database lookup. When the request path contains no ownership or authorization check, CodeRabbit Security establishes whether the route is reachable and presents the entry-to-sink evidence supporting the finding.

By following the full path, it surfaces authorization-bypass chains, business-logic flaws, and prompt-injection paths that are only exploitable because of how the application is designed. Finding them means working the codebase the way an attacker would, testing hypotheses, and keeping only what the code supports.

Inside CodeRabbit Security’s four-stage workflow

The end-to-end experience follows four connected stages: Map, Hunt, and Verify cover the analysis, and Fix begins once a finding survives verification. Each stage hands the next one the application context and supporting code it needs to take the investigation further.

CodeRabbit Security follows a four-stage workflow: Map, Hunt, Verify, and Fix.

Map

AI agents explore the repository inside a secure sandbox and build a system-level map of the application. They identify entry points, trust boundaries, authentication and authorization checks, and the relationships between them.

They also build a reachability graph connecting externally accessible inputs to the code and resources they can affect. This focuses the investigation on attack paths that fit the application’s architecture.

Hunt

The map narrows the field. Specialized agents investigate different risk areas in parallel, including authorization, injection, business logic, data exposure, and AI-specific threats.

They trace attacker-controlled input from entry point to sink, examine the trust boundaries and controls along the way, and gather supporting code for each candidate vulnerability.

Verify

Before CodeRabbit publishes a finding, it has to hold up under independent verification.

The verifier reopens the cited paths and checks whether the code is reachable, whether safeguards exist elsewhere in the application, whether the conditions required for exploitation can occur, and whether the evidence supports the claimed impact.

Duplicates are removed. Candidates are also rejected when they depend on test-only or unreachable code, overlook existing protections, or rest on unsupported assumptions. And when the evidence doesn't support a conclusion either way, CodeRabbit says so rather than treating incomplete analysis as proof that a vulnerability is exploitable or that the repository is secure.

Fix

For eligible findings, Fix with AI uses the confirmed attack path and application context to draft a scoped remediation on a security branch and open a reviewable pull request or merge request. The PR preserves the technical account behind the finding, from entry point and sink through the reachability analysis, exploitation conditions, and potential impact.

Developers inspect the patch, review the reasoning, and run their existing tests and checks before deciding whether to merge. The finding, its evidence, the proposed fix, and the review history stay together in the development workflow instead of scattering across a scanner dashboard, a ticketing system, and a separate remediation project.

Teams can also add repository context, create Security Learnings, and write custom path instructions. CodeRabbit applies relevant guidance during subsequent AI Deep Scans, helping the analysis reflect the application's architecture and the team's documented decisions without treating that guidance as evidence by itself.

Security results are organized across dedicated views for AI Deep Scan findings, PR Findings, dependencies, secrets, software bills of materials, and attack-surface information. Supported results can be shared or exported in formats including CSV, JSON, SARIF, PDF, CycloneDX, and SPDX, depending on the result type.

Continuous coverage across every PR and the full codebase

A lock at the center of a continuous loop illustrates CodeRabbit Security protecting the codebase before and after merge.

An application's security posture shifts with every merge, including in code that didn't change. CodeRabbit Security watches it from two complementary scopes.

AI Deep Scan analyzes committed source code and infrastructure configuration across an entire repository. Teams can run it on demand across supported providers or on a recurring schedule for GitHub repositories. It surfaces risks in code that shipped months or years ago, giving the application a security baseline.

PR Findings capture security issues raised during pull request reviews, while the intent behind the proposed change is still fresh. These findings are presented separately from AI Deep Scan results so teams can distinguish between risks in an incoming change and vulnerabilities found across committed code.

Together, AI Deep Scan and PR Findings give teams a view of security before and after merge, while keeping the two types of analysis distinct.

How CodeRabbit Security fits into Agentic Change Management

CodeRabbit started as an independent AI review layer for pull requests. CodeRabbit Security carries that approach beyond the pull request as part of Agentic Change Management, a broader system for governing software change before and after merge.

AI review independently checks each proposed change before merge. CodeRabbit Triage helps teams prioritize and route incoming work. Change Stack explains what a change means, how it affects the architecture, and how far its impact reaches. Security carries application context beyond merge and turns verified risks back into pull requests.

The result is one control layer for evaluating proposed changes and maintaining the code that ships.

See it on your own code

CodeRabbit Security is built on the same security and privacy foundation as CodeRabbit, with encryption in transit and at rest and independently audited SOC 2 Type II controls. The CodeRabbit Trust Center contains current information about data handling, retention, and compliance.

CodeRabbit Security is available now for GitHub Cloud and GitHub Enterprise Server, GitLab Cloud and self-hosted GitLab, Azure DevOps Services, and Bitbucket Cloud. Teams can open Security in the CodeRabbit app or follow the documentation to get started.

Check out CodeRabbit Security and evaluate it on your repositories now.

When we founded CodeRabbit, AI was already changing how software was written. We saw where the industry was going and there was one question that we knew would become increasingly important. Who would independently verify all of that code?

That led us to create the first AI code review product. Over the last four years, CodeRabbit became the industry-leading independent AI code review layer. It understands your codebase, learns from your team, and gives developers evidence-based feedback they can trust and act on.

Fast forward to today. We’re announcing two milestones.

The first is that less than a year after raising our Series B, we raised $143 million in a Series C funding round at a $1.5 billion valuation. Atomico and Smash Capital co-led the round, with participation from new investors, including BMW i Ventures, Datadog, Hirtle Callaghan, SineWave Ventures, Scenic Management and our existing investors, including CRV, Scale Venture Partners, Flex Capital, Pelion Venture Partners, Harmony Partners and Engineering Capital.

We’re also introducing a new product category we call Agentic Change Management, a platform that represents the next chapter for CodeRabbit. In conversations with thousands of teams trying to navigate the changes AI coding agents have made to their workflows, we realized that AI code review only solves part of the problem.

Agentic Change Management requires a full suite of tools to help teams validate what should ship, prioritize where developer attention and time generate the most value, explain the intent and risk of the massive PRs AI generates, and keep their codebase healthy after merge in the face of increased AI security threats.

Issue tracking is dead. And that’s changing everything.

It used to be that implementation was expensive. Teams discussed what to build, established priorities, assigned the work, and then carefully invested scarce engineering time in turning an idea into code.

The high cost of implementation forced planning and judgment to happen before the code existed.

AI is reversing that sequence.

A product requirement, support ticket, security finding, or production alert can now easily and quickly become a proposed code change with the rise of autofix features.

Coding agents can work for hours, produce thousands of lines, and open pull requests with limited human involvement. Anyone on your team can initiate code changes, be they developers, product managers, designers, or even marketers.

The shift is compounding. GitHub is on pace to record 14x more commits this year. Among companies in the 90th percentile of coding-agent adoption, autonomous agents open 35% of PRs.

Because of that, code increasingly exists before a team has decided whether the work is valuable, how it should be prioritized, or whether it deserves engineering attention. The backlog is moving from tickets to pull requests.

And that shift fundamentally changes the role of the PR.

The PR is set to become the auditable planning and decision point where the team determines what to ship and whether a change meets the quality bar, what risks it introduces, how it affects the larger system, and whether it is ready to ship.

The problem teams now need to solve is the fact that human attention remains finite while the PR backlogs continue to grow. Large scale agent outputs exceed the time humans have to understand them. Every PR adds new relationships, dependencies, security exposure, and maintainability risk to the codebase.

The new bottleneck is judgment.

Introducing the Agentic Change Management platform

The Agentic Change Management platform is the control layer for software changes created by humans and agents.

It extends CodeRabbit’s independent AI code review into one connected system that validates changes, prioritizes attention, explains impact, and continuously monitors the shipped codebase.

Proposed changes should come with evidence, a priority, and an explanation people can understand, and the codebase they land in should stay secure and governable as it evolves.

Independent AI code review remains the foundation. CodeRabbit evaluates changes using multi-repository context, organizational standards, pre-merge checks, team knowledge, and evidence from isolated test environments. It challenges the assumptions behind a change and verifies suspected failures before a human reviewer invests time.

And today, we are introducing three new capabilities:

• CodeRabbit Triage
• CodeRabbit Change Stack
• CodeRabbit Security

Together, they bring prioritization, code explainability, and continuous codebase monitoring into the same independent code review system.

CodeRabbit Triage directs attention

As change volume grows, the pull request queue becomes a decision system.

Arrival order gives teams little information about where to spend their time. A production fix, a security change, an incomplete experiment, and a low-risk refactor should each follow a path that reflects its value, urgency, readiness, and risk.

CodeRabbit Triage:

• Scores and routes incoming changes using factors such as value, urgency, risk, dependencies, readiness, and reviewer fit.
• Directs consequential work to human reviewers, and moves low-risk changes into automated workflows.
• Filters duplicate, irrelevant, or unready work.

This gives teams a clearer basis for deciding what should move first, what can wait, and where human judgment will have the greatest impact. The queue begins to reflect organizational priorities instead of the order in which pull requests arrived.

The goal is to make the team more effective as the volume of proposed work grows. The most valuable agents will contribute to the team’s priorities and help direct limited attention toward the changes that create the greatest value or carry the greatest consequence.

CodeRabbit Change Stack explains the change

A diff shows what changed. Change Stack shows what it means.

The traditional GitHub PR interface puts the diff at the center of review. That worked when people wrote the code and changes arrived at a pace reviewers could follow. Agent-generated changes break that assumption. As their volume and scope increase, line-by-line review becomes the wrong starting point.

CodeRabbit’s review agent can handle the details in the diff. Change Stack helps humans understand the change itself: how the pieces connect, which contracts and behaviors it affects, whether it introduces a migration or changes an integration, how far the impact reaches, and who needs to weigh in.

CodeRabbit Change Stack:

• Helps you understand a massive agent-generated diff in minutes.
• Organizes the agent-generated changes into semantic layers, grouping related modifications into a guided explanation of how the change works.
• Surfaces the purpose and risk and shows how they affect the broader system.
• Helps reviewers quickly identify the work that can move forward and the areas that require deeper judgment.

We believe explainability will become a foundational part of software development as AI generation becomes more complex.

Production observability gives teams a way to understand a running system. Code explainability gives them a way to understand the decisions and behavior entering that system. It preserves the shared understanding teams need as code output accelerates.

CodeRabbit Security protects what has shipped

Every merge changes a living system.

Dependencies evolve. New vulnerabilities emerge. Data flows change. Architectural assumptions age. Code that appeared safe in one context can become risky through its interaction with the rest of the codebase.

Large language models are also lowering the cost and expertise required to discover software vulnerabilities. Defenders and attackers can examine more code and test more attack paths at greater speed and scale.

CodeRabbit Security:

• Applies the same codebase-wide understanding and independent reasoning used during review to code already running in production.
• Analyzes relationships across files, services, data flows, authorization boundaries, and trust boundaries.
• Identifies complex security and business-logic risks that fixed rules and file-level pattern matching can miss.

Each finding is grounded in code evidence. CodeRabbit Security verifies whether a vulnerable path is real and reachable, prioritizes remediation, and sends proposed fixes back through the pull request workflow. The same control layer that evaluates incoming changes continues protecting the code after it ships.

Over time, continuous maintenance will also address drift, duplication, technical debt, and the broader entropy that accumulates across a changing codebase. The objective is to keep the system healthy as thousands of human- and agent-generated changes become part of it.

AI that keeps humans in the loop

A proposed change affects everyone who interacts with the code in an organization including authors, reviewers, maintainers, security teams, and everyone who inherits the system. Its value depends on whether the organization can understand it, trust it, govern it, operate it, and maintain it.

AI can do a lot of things well. But people remain responsible for intent, architecture, product judgment, acceptable risk, and the consequences of what ultimately ships. Our job is to help that judgment scale by making it much simpler for humans to remain in the loop.

And we’re doing that by drawing on the industry-leading context we gather about your codebase when doing your code reviews. CodeRabbit develops a semantic understanding of how the codebase fits together, learns the team's standards, and accumulates knowledge with every review. The same context supports validation, prioritization, and continuous monitoring, so it verifies findings in isolated environments, applies policies consistently across repositories, and gives developers and agents a shared view of each change.

Organizations will use many coding agents, and people will work across different tools and workflows. CodeRabbit gives them one independent quality and governance system across those agents, repositories, and development environments.

Why we’re raising now

Over the past year, CodeRabbit’s revenue grew more than 5x and the platform now conducts more than 2 million code reviews each week. Over 17,000 customers and 150,000 open-source projects trust CodeRabbit to improve the quality and reliability of their software.

The Series C funding gives us the resources to accelerate international expansion and invest more deeply in the research, infrastructure, and product capabilities required to make the Agentic Change Management platform work at a global scale. We also plan to invest more than $10 million to keep AI code review and agent capabilities free for open source projects and maintainers over the next 12 months.

CodeRabbit will also continue building the context, verification, prioritization, explainability, security, and collaboration systems that organizations need as software change accelerates. Thank you for joining us on our journey as we built the first AI code review tool and transformed how people reviewed code.

We’re excited for the next chapter.

CLI v0.7.2

CLI v0.7.2 expands regional authentication and improves reliability for local and agent-driven reviews.

Use coderabbit auth login --region eu for EU OAuth or API-key sign-in (or --region us for US), or run coderabbit review --region eu --api-key <key> for one API-key review. Saved sign-ins retain the selected region, coderabbit auth status displays it, wrong-region accounts get a recovery command, and US remains the default.

Reviews now stop promptly when their live connection drops, avoiding long waits and duplicate terminal errors.

Supported --agent commands now return one structured, machine-readable error for invalid commands or options.

After a review with no new findings, the CLI shows the previous finding count and command to view it, while coderabbit review findings skips empty sessions.

External instruction paths saved in review history no longer block later reviews.

See the CLI documentation and CLI Command Reference for current usage and options.

CLI v0.7.1

CLI v0.7.1 adds validation and authentication improvements for local and coding-agent workflows.

coderabbit config validate now checks YAML syntax against the current official schema, reports line-oriented errors, and returns CI-friendly exit codes.

Coding agents can use a runtime-provisioned, task-scoped capability without an interactive sign-in or shared API key. Agent login uses localhost callbacks and never asks you to paste an OAuth token; unsupported environments hand off to interactive login.

Self-managed GitLab users can complete authentication for an organization selected beyond the initial discovery limit.

Legacy GitHub sessions with a verified paid seat can use enabled usage-based reviews after included limits, with more accurate sign-in and seat guidance.

Interrupted agent-driven reviews preserve final CLI output and are reported as partial rather than complete.

See the CLI documentation and CLI Command Reference for current usage and options.

Cache management

CodeRabbit speeds up reviews and Finishing Touch runs by reusing a sandbox cache (a prepared copy of a repository and its installed dependencies) instead of rebuilding it from scratch every time.

The newly added Review > Caches tool gives organizations visibility and control over it. Users with Read access to Repository Settings can view and search the list; organization administrators with Write access can delete a cache to force an immediate rebuild. The next review, chat, or fix for that repository takes longer while CodeRabbit rebuilds the cache. See the caching documentation for more details.

Review MCP presets

The root Connections picker now offers prefilled presets for Context7, GitHub Copilot, Monday.com, ClickUp, and DeepWiki. These five are part of the nine suggested CodeRabbit PR Review MCP servers.

Each preset fills in the provider endpoint and authentication method, so you do not need to use the manual custom MCP form. Notion, Linear, Sentry, and Asana continue to appear through their existing entries and are not duplicated here. See the MCP servers documentation for details.

CLI v0.7.0

CLI v0.7.0 clarifies what coderabbit review scans by default, helps you recover gracefully when a scope is too large, and adds first-party support for Antigravity and CodeRabbit Skills.

By default, coderabbit review now covers all tracked changes — committed, staged, and unstaged edits — with --committed, --uncommitted, and --include-untracked available to narrow or extend that scope. If a review is skipped for having too many files, the CLI now suggests narrower commands (with file-count estimates) instead of just failing, though you still choose and rerun a suggestion manually; file limits and server policy are unchanged.

The CLI also detects Antigravity CLI sessions and recommends --agent for structured output, and adds a new coderabbit skills command to install or update verified CodeRabbit skills for Codex, Claude Code, Cursor, Gemini CLI, and GitHub Copilot, previewing changes before a single confirmation prompt.

Finally, the obsolete --plain, --fast, --interactive, --cwd, and --prompt-only flags are removed; use --light, --dir, and --agent respectively where applicable.

See the CLI documentation, CLI Command Reference, and CodeRabbit Skills for current usage and options.

Review Progress Reports

CodeRabbit now publishes its canonical, user-facing review status and progress through GitHub progress reports and check runs by default, so you can follow a review's status without relying on commit statuses.

If your required checks or automations depend on the legacy commit status, enable reviews.commit_status; it applies only while reviews.review_progress is disabled. reviews.fail_commit_status still controls failure reporting, applying to whichever status surface is active.

See the configuration reference for details.