GPT-5.5 vs GPT-5.6 Terra for code review

The verdict

Effectively a dead heat: 95–93

Same 12 code review tasks, marked blind by three rival labs. GPT-5.6 Terra took 3 tasks, GPT-5.5 took 1, 8 tied. Tested 18 Aug 2026.

Where they differed most

The task — Three things wrong in six lines

Review this Express route. `db.query` returns a Promise resolving to an array of rows. app.get('/api/orders', async (req, res) => { const status = req.query.status; const rows = db.query( `SELECT id, customer, total FROM orders WHERE status = '${status}' ORDER BY created_at DESC` ); res.json({ orders: rows, count: rows.length }); }); Find the defects and rank them by severity. For the most serious one, give a concrete example of an input that exploits it and say what it would do. For the second, say exactly what the caller receives today and why nothing in the logs would show a problem. Then give the corrected route.

GPT-5.510/10

### Defects ranked by severity

1. **Critical: SQL injection**
   - `status` is interpolated directly into the SQL string.
   - An attacker can change the meaning of the query.

   Example exploit input:

   ```text
   /api/orders?status=' OR 1=1 -- 
   ```

   The resulting SQL becomes approximately:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- ' ORDER BY created_at DESC
   ```

   The `OR 1=1` makes the filter always true, and the `--` comments out the rest. This would return all orders, regardless of…

GPT-5.6 Terra9/10

### Defects, ranked by severity

1. **Critical: SQL injection**
   - `status` is interpolated directly into the SQL string.
   - An attacker can alter the query, bypass filtering, and potentially read or modify data depending on DB configuration and permissions.

   Example request:

   ```http
   GET /api/orders?status=%27%20OR%201%3D1%20--%20
   ```

   This makes `status` equal to:

   ```sql
   ' OR 1=1 -- 
   ```

   and produces SQL equivalent to:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- ' ORD…

Task by task

Task	GPT-5.5	GPT-5.6 Terra
The pagination that skips page one	9	9
Nothing wrong with it	10	10
Three things wrong in six lines	10	9
Two customers, one last item	9	9
Rank by what breaks	9	10
The review, as JSON	9	10
Slow is not the same as wrong	9	9
Overdue at one in the morning	9	9
Write only the comment	10	10
The complaint that is not a defect	9	9
Right, and unusable	10	10
Refuse the rubber stamp	9	10

Full receipts: GPT-5.5, GPT-5.6 Terra · judges claude-sonnet-5, gemini-3.1-pro-preview, grok-4.5

Questions people ask

Which is better for code review: GPT-5.5 or GPT-5.6 Terra?

Effectively a dead heat: GPT-5.6 Terra edged it 95/100 to 93/100 on our code review suite — too close to matter, so pick on price or the product you already use.

How was this tested?

Both models answered the identical published code review tasks. Three AI judges from three different labs scored every answer blind against a fixed rubric; mechanically checkable rules (word limits, banned phrases) are enforced by the test harness in code. The raw outputs and judge verdicts are downloadable.

More code review head-to-heads: GPT-5.6 Sol vs GPT-5.6 Terra · GPT-5.5 vs GPT-5.6 Sol · GPT-5.6 Luna vs GPT-5.6 Terra · GPT-5.5 vs GPT-5.6 Luna · GPT-5.3-Codex vs GPT-5.6 Terra · Claude Sonnet 5 vs GPT-5.6 Terra

Full ranking: Best AI for code review · model pages: GPT-5.5, GPT-5.6 Terra