GPT-5.6 Luna vs GPT-5.6 Terra for code review

The verdict

Dead heat: 95 each

Same 12 code review tasks, marked blind by three rival labs. Tested 27 Aug 2026.

Where they differed most

The task — Three things wrong in six lines

Review this Express route. `db.query` returns a Promise resolving to an array of rows. app.get('/api/orders', async (req, res) => { const status = req.query.status; const rows = db.query( `SELECT id, customer, total FROM orders WHERE status = '${status}' ORDER BY created_at DESC` ); res.json({ orders: rows, count: rows.length }); }); Find the defects and rank them by severity. For the most serious one, give a concrete example of an input that exploits it and say what it would do. For the second, say exactly what the caller receives today and why nothing in the logs would show a problem. Then give the corrected route.

GPT-5.6 Luna10/10

### Defects ranked by severity

1. **Critical: SQL injection**
   `status` is interpolated directly into the SQL string.

   Example input:

   ```text
   ' OR 1=1 -- 
   ```

   produces a query equivalent to:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- '
   ORDER BY created_at DESC
   ```

   The `WHERE` condition is always true, so the caller can retrieve all orders instead of only orders with the requested status. Depending on the database driver and configuration, more damaging injected SQL may al…

GPT-5.6 Terra9/10

### Defects, ranked by severity

1. **Critical: SQL injection**
   - `status` is interpolated directly into the SQL string.
   - An attacker can alter the query, bypass filtering, and potentially read or modify data depending on DB configuration and permissions.

   Example request:

   ```http
   GET /api/orders?status=%27%20OR%201%3D1%20--%20
   ```

   This makes `status` equal to:

   ```sql
   ' OR 1=1 -- 
   ```

   and produces SQL equivalent to:

   ```sql
   SELECT id, customer, total
   FROM orders
   WHERE status = '' OR 1=1 -- ' ORD…

Task by task

Task	GPT-5.6 Luna	GPT-5.6 Terra
The pagination that skips page one	9	9
Nothing wrong with it	10	10
Three things wrong in six lines	10	9
Two customers, one last item	9	9
Rank by what breaks	9	10
The review, as JSON	9	10
Slow is not the same as wrong	10	9
Overdue at one in the morning	10	9
Write only the comment	10	10
The complaint that is not a defect	9	9
Right, and unusable	9	10
Refuse the rubber stamp	10	10

Full receipts: GPT-5.6 Luna, GPT-5.6 Terra · judges claude-sonnet-5, gemini-3.1-pro-preview, grok-4.5

Questions people ask

Which is better for code review: GPT-5.6 Luna or GPT-5.6 Terra?

They tied at 95/100 on our code review suite — for this job, pick on price or the product you already use.

How was this tested?

Both models answered the identical published code review tasks. Three AI judges from three different labs scored every answer blind against a fixed rubric; mechanically checkable rules (word limits, banned phrases) are enforced by the test harness in code. The raw outputs and judge verdicts are downloadable.

More code review head-to-heads: GPT-5.6 Luna vs GPT-5.6 Sol · GPT-5.6 Sol vs GPT-5.6 Terra · GPT-5.3-Codex vs GPT-5.6 Luna · GPT-5.5 vs GPT-5.6 Luna · Claude Sonnet 5 vs GPT-5.6 Luna · GPT-5.6 Luna vs Grok 4.5

Full ranking: Best AI for code review · model pages: GPT-5.6 Luna, GPT-5.6 Terra