GPT-5.6 Luna vs GPT-5.6 Sol for code review

The verdict

Effectively a dead heat: 96–95

Same 12 code review tasks, marked blind by three rival labs. GPT-5.6 Sol took 3 tasks, GPT-5.6 Luna took 2, 7 tied. Tested 27 Aug 2026.

Where they differed most

The task — Three things wrong in six lines

Review this Express route. `db.query` returns a Promise resolving to an array of rows. app.get('/api/orders', async (req, res) => { const status = req.query.status; const rows = db.query( `SELECT id, customer, total FROM orders WHERE status = '${status}' ORDER BY created_at DESC` ); res.json({ orders: rows, count: rows.length }); }); Find the defects and rank them by severity. For the most serious one, give a concrete example of an input that exploits it and say what it would do. For the second, say exactly what the caller receives today and why nothing in the logs would show a problem. Then give the corrected route.

GPT-5.6 Luna10/10

### Defects ranked by severity

1. **Critical: SQL injection**
   `status` is interpolated directly into the SQL string.

   Example input:

   ```text
   ' OR 1=1 -- 
   ```

   produces a query equivalent to:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- '
   ORDER BY created_at DESC
   ```

   The `WHERE` condition is always true, so the caller can retrieve all orders instead of only orders with the requested status. Depending on the database driver and configuration, more damaging injected SQL may al…

GPT-5.6 Sol9/10

### Defects, ranked by severity

1. **Critical — SQL injection**
   `status` is inserted directly into the SQL string. An attacker can change the query’s logic or potentially execute additional statements, depending on the database/driver configuration.

   Example request:

   ```text
   /api/orders?status=x%27%20OR%201%3D1%20--%20
   ```

   This produces approximately:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = 'x' OR 1=1 -- ' ORDER BY created_at DESC
   ```

   The comment removes the rest of the statement, an…

Task by task

Task	GPT-5.6 Luna	GPT-5.6 Sol
The pagination that skips page one	9	9
Nothing wrong with it	10	10
Three things wrong in six lines	10	9
Two customers, one last item	9	10
Rank by what breaks	9	9
The review, as JSON	9	10
Slow is not the same as wrong	10	10
Overdue at one in the morning	10	10
Write only the comment	10	10
The complaint that is not a defect	9	9
Right, and unusable	9	10
Refuse the rubber stamp	10	9

Full receipts: GPT-5.6 Luna, GPT-5.6 Sol · judges claude-sonnet-5, gemini-3.1-pro-preview, grok-4.5

Questions people ask

Which is better for code review: GPT-5.6 Luna or GPT-5.6 Sol?

Effectively a dead heat: GPT-5.6 Sol edged it 96/100 to 95/100 on our code review suite — too close to matter, so pick on price or the product you already use.

How was this tested?

Both models answered the identical published code review tasks. Three AI judges from three different labs scored every answer blind against a fixed rubric; mechanically checkable rules (word limits, banned phrases) are enforced by the test harness in code. The raw outputs and judge verdicts are downloadable.

More code review head-to-heads: GPT-5.6 Sol vs GPT-5.6 Terra · GPT-5.3-Codex vs GPT-5.6 Sol · GPT-5.5 vs GPT-5.6 Sol · Claude Sonnet 5 vs GPT-5.6 Sol · GPT-5.6 Sol vs Grok 4.5 · GPT-5.6 Sol vs Qwen3.7 Max

Full ranking: Best AI for code review · model pages: GPT-5.6 Luna, GPT-5.6 Sol