GPT-5.5 vs GPT-5.6 Sol for code review

The verdict

GPT-5.6 Sol wins, 96–93

Same 12 code review tasks, marked blind by three rival labs. GPT-5.6 Sol took 4 tasks, GPT-5.5 took 1, 7 tied. Tested 18 Aug 2026.

Where they differed most

The task — Three things wrong in six lines

Review this Express route. `db.query` returns a Promise resolving to an array of rows. app.get('/api/orders', async (req, res) => { const status = req.query.status; const rows = db.query( `SELECT id, customer, total FROM orders WHERE status = '${status}' ORDER BY created_at DESC` ); res.json({ orders: rows, count: rows.length }); }); Find the defects and rank them by severity. For the most serious one, give a concrete example of an input that exploits it and say what it would do. For the second, say exactly what the caller receives today and why nothing in the logs would show a problem. Then give the corrected route.

GPT-5.510/10

### Defects ranked by severity

1. **Critical: SQL injection**
   - `status` is interpolated directly into the SQL string.
   - An attacker can change the meaning of the query.

   Example exploit input:

   ```text
   /api/orders?status=' OR 1=1 -- 
   ```

   The resulting SQL becomes approximately:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- ' ORDER BY created_at DESC
   ```

   The `OR 1=1` makes the filter always true, and the `--` comments out the rest. This would return all orders, regardless of…

GPT-5.6 Sol9/10

### Defects, ranked by severity

1. **Critical — SQL injection**
   `status` is inserted directly into the SQL string. An attacker can change the query’s logic or potentially execute additional statements, depending on the database/driver configuration.

   Example request:

   ```text
   /api/orders?status=x%27%20OR%201%3D1%20--%20
   ```

   This produces approximately:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = 'x' OR 1=1 -- ' ORDER BY created_at DESC
   ```

   The comment removes the rest of the statement, an…

Task by task

Task	GPT-5.5	GPT-5.6 Sol
The pagination that skips page one	9	9
Nothing wrong with it	10	10
Three things wrong in six lines	10	9
Two customers, one last item	9	10
Rank by what breaks	9	9
The review, as JSON	9	10
Slow is not the same as wrong	9	10
Overdue at one in the morning	9	10
Write only the comment	10	10
The complaint that is not a defect	9	9
Right, and unusable	10	10
Refuse the rubber stamp	9	9

Full receipts: GPT-5.5, GPT-5.6 Sol · judges claude-sonnet-5, gemini-3.1-pro-preview, grok-4.5

Questions people ask

Which is better for code review: GPT-5.5 or GPT-5.6 Sol?

GPT-5.6 Sol — it scored 96/100 against 93/100 on our 12-task code review suite, winning 4 tasks to 1 with 7 tied. Every answer was marked blind by three judges from three rival AI labs.

How was this tested?

Both models answered the identical published code review tasks. Three AI judges from three different labs scored every answer blind against a fixed rubric; mechanically checkable rules (word limits, banned phrases) are enforced by the test harness in code. The raw outputs and judge verdicts are downloadable.

More code review head-to-heads: Claude Sonnet 5 vs GPT-5.6 Sol · GPT-5.6 Sol vs Grok 4.5 · GLM 5.2 vs GPT-5.6 Sol · GPT-5.6 Sol vs Kimi K3 · Gemini 3.1 Pro Preview vs GPT-5.6 Sol · Gemini 3.5 Flash vs GPT-5.6 Sol

Full ranking: Best AI for code review · model pages: GPT-5.5, GPT-5.6 Sol