{"slug": "gemini-3-6-flash-on-iac-bench-2026-10", "title": "Gemini 3.6 Flash on iac-bench 2026-10", "summary": "Gemini 3.6 Flash scored an overall composite of 54.3 (95% CI 40.0–61.5) on iac-bench 2026-10, ranking 10th of 10 models evaluated, with security findings in 8 of 9 attempts and 1 failed gate, according to the benchmark's published results. The model's defining habit was shipping secure values as defaults on consumer-facing inputs rather than fixed properties — the S3 public access block, Cloud SQL public IP and ssl_mode, and App Service HTTPS were all unvalidated inputs — and it lost rubric item H1 in all 8 attempts that planned. Its resource mechanics were consistently sound, and the 9 attempts cost an estimated $3.14 at a list price of $0.75/$3.75 per million input/output tokens (OpenRouter, 2026-10-23).", "body_md": "Upcoming Workshop: Citizen Developer Agentic Software Factory on AWS 11.4.26 @ 12PM PST\n\n[Register Here!](https://streamyard.com/watch/umMggUFkVMNu)\n\nHow Gemini 3.6 Flash did on iac-bench 2026-10: an overall composite of 54.3, scores per fixture, strengths, weaknesses and the patterns in its OpenTofu modules.\n\n| Developer |  | \n| API identifier | `gemini-3.6-flash` | \n| Access | Gemini API | \n| Weights | Closed | \n| List price (USD / M tokens, in / out) | 0.75 / 3.75 (OpenRouter, 2026-10-23) | \n| Evaluated | 2026-10-22 (generation) · 2026-10-23 (judge) | \n| Attempts | 9 (3 fixtures × 3 samples) | \n| **Overall composite** | **54.3** (95% CI 40.0–61.5) | \n| Rank | 10 of 10 (95% rank interval 10–10) | \n| Mechanical only / judge only | 50.9 (rank 10) / 62.3 (rank 10) | \n| Failed gates · insecure attempts | 1/9 · 8/9 | \n| Estimated cost, all 9 attempts | $3.14 | \n\nGemini 3.6 Flash places last, with security findings in 8 of 9 attempts and one failed\ngate. Its defining habit is to ship secure values as *defaults on consumer-facing inputs*\nrather than as fixed properties. The S3 public access block, Cloud SQL public IP and\n`ssl_mode`, and App Service HTTPS are all inputs, each with a safe default and no\nvalidation.\n\nThat one habit drives most of its losses:\n\n`H1` lost in every attempt that planned (8/8);\nIts resource mechanics, by contrast, are consistently sound.\n\n| Fixture | Composite median (range) | Rubric median | Expertise | Judge median | ✗ gate | ⚠ security | Median inputs | Median output tokens | Median time | Median cost | \n|---|---|---|---|---|---|---|---|---|---|---|\n| G001 · S3 | 62.8 (55.9–65.1) | 0.581 | 4/7 | 73.7 | 0/3 | 3/3 ( `H1` ) | 22 | 18,077 | 235 s | $0.164 | \n| G002 · Cloud SQL | 49.2 (48.2–59.2) | 0.454 | 6/9 | 55.3 | 0/3 | 3/3 ( `H1` ,`H2` ) | 33 | 28,188 | 238 s | $0.297 | \n| G003 · App Service | 51.0 (15.0–62.4) | 0.472 | 3/5 | 57.9 | 1/3 | 2/3 ( `H1` ,`H2` ) | 40 | 51,324 | 666 s | $0.473 | \n\nRubric items not at full credit, counted over attempts that planned: G001: `A3` 3/3, `A5` 3/3, `B1` 1/3, `H1` 3/3, `H9` 1/3, `H12` 3/3, `H13` 3/3, `H15` 2/3; G002: `A8` 3/3, `B1` 2/3, `H1` 3/3, `H2` 3/3, `H4` 1/3, `H5` 1/3, `H7` 3/3, `H9` 3/3, `H10` 3/3, `H11` 3/3; G003: `A6` 2/2, `A7` 2/2, `H1` 2/2, `H2` 2/2, `H3` 1/2, `H4` 1/2, 1 attempt failed the gate. Definitions are in [Scoring criteria](https://www.massdriver.cloud/blogs/iac-bench-2026-10-scoring-criteria).\n\n`H2`, 3/3.` ipv4_enabled` is an input.`ssl_mode` is an unvalidated string, and its own description lists the unencrypted mode\n(excerpt below).`database_flags` turn IAM authentication off.`https_only` is missing on the\nslot or exposed as an input, and the basic-auth publishing flags are never set.`H7`, `H10`, 3/3).` validation` blocks across all nine modules.`test*.tf` files.\n`G002/gemini-3.6-flash-e1/variables.tf` lines 65–75\n\n```\nvariable \"ipv4_enabled\" {\n  description = \"Whether public IPv4 is assigned to the instance. Default is false (Private IP only).\"\n  type        = bool\n  default     = false\n}\n\nvariable \"ssl_mode\" {\n  description = \"SSL/TLS connection mode: ENCRYPTED_ONLY, TRUSTED_CLIENT_CERTIFICATE_REQUIRED, or ALLOW_UNENCRYPTED_AND_ENCRYPTED.\"\n  type        = string\n  default     = \"ENCRYPTED_ONLY\"\n}\n```\n\nBoth defaults are secure, but each control is an unvalidated consumer input, and the description advertises the unencrypted mode. This fails both mandatory Cloud SQL items.\n\nHow Claude Fable 5.1 did on iac-bench 2026-10: an overall composite of 86.9, scores per fixture, strengths, weaknesses and the patterns in its OpenTofu modules.\n\nHow Claude Haiku 5.5 did on iac-bench 2026-10: an overall composite of 68.0, scores per fixture, strengths, weaknesses and the patterns in its OpenTofu modules.\n\nHow Claude Opus 5.5 did on iac-bench 2026-10: an overall composite of 88.9, scores per fixture, strengths, weaknesses and the patterns in its OpenTofu modules.", "url": "https://wpnews.pro/news/gemini-3-6-flash-on-iac-bench-2026-10", "canonical_source": "https://www.massdriver.cloud/blogs/iac-bench-2026-10-gemini-3-6-flash", "published_at": "2026-11-04 00:00:00+00:00", "updated_at": "2026-11-04 20:21:35.854677+00:00", "lang": "en", "topics": ["ai-research", "large-language-models", "ai-safety", "ai-tools"], "entities": ["Gemini 3.6 Flash", "Google", "iac-bench", "OpenTofu", "AWS", "Cloud SQL", "Claude Fable 5.1", "Claude Opus 5.5"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/gemini-3-6-flash-on-iac-bench-2026-10", "markdown": "https://wpnews.pro/news/gemini-3-6-flash-on-iac-bench-2026-10.md", "text": "https://wpnews.pro/news/gemini-3-6-flash-on-iac-bench-2026-10.txt", "jsonld": "https://wpnews.pro/news/gemini-3-6-flash-on-iac-bench-2026-10.jsonld"}}