Gemini 3.1 Pro: 77.1% on ARC-AGI-2 and a new agent baseline
Technical Gemini 3.1 Pro analysis: ARC-AGI-2 score, API and Vertex AI, code-based animation, agent workflows, benchmark limits and governance.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 19 February 2026
- READING TIME
- 15 min read
- TOPIC
- AI Security
Google released Gemini 3.1 Pro in preview on 19 February 2026 through the Gemini API, AI Studio, Gemini CLI, Antigravity, Android Studio and Vertex AI, plus Gemini and NotebookLM. Google positioned it as a new complex-reasoning baseline and reported 77.1% verified on ARC-AGI-2, more than twice Gemini 3 Pro in Google’s setup.
The interesting change is how reasoning becomes an artefact: complex-system synthesis, code-generated SVG animation, multi-source work and agent workflows. Output can now be executed, published or used for decisions, increasing both utility and consequences.
What ARC-AGI-2 does not prove
ARC-AGI-2 tests novel logical patterns from limited examples. It signals abstraction ability but does not measure business factuality, secure code, regulatory compliance or every language. “More than double” also depends on baseline and test settings.
Separate closed-task reasoning, source grounding, tool selection, artefact correctness, prompt-injection resistance, whole-workflow cost and latency. A model can solve a hard puzzle and still call an API with the wrong tenant.
Component, not application
Consumer, developer and enterprise channels differ in retention, identity, data location, limits and integration. An AI Studio prototype is not automatically a production architecture. Use the channel whose contract and controls match the data.
Put API access behind a gateway assigning tenant, budgets, classification, tool policy and observability. Pin model IDs; a “latest” alias can change behaviour without an application commit.
Generated SVG and interfaces
Google demonstrated animated SVG generation. SVG is lightweight but can carry scripts, external resources, links and unsafe constructs when embedded incorrectly. Never inject raw model output into the DOM. Apply allowlist sanitisation, CSP, sandboxing and removal of handlers and external references. Treat generated HTML/JS as untrusted code.
Long agent workflows
Better reasoning makes delegation attractive but increases blast radius. Gemini CLI or Antigravity can read repositories, run builds, edit files and call services. Enforce actions outside the prompt.
Use read-only discovery in a sandbox, an explicit plan, scoped tools, approval for external or destructive work, automated tests, cited evidence and a complete request-tool-result audit trail. Repository instructions are attacker-controlled data, not authority to expand permissions.
Compare systems fairly
Use the same harness and tools with multiple trials. Report pass@1, cost per correct task, time, tool calls, bad mutations and human interventions. Add language-specific screenshots, charts and noisy documents for multimodal tests.
Vendor benchmarks are inputs; the decision question is whether the model completes your process under your constraints.
A production gateway for Gemini
A central gateway should separate projects, regions and data classes, enforce token budgets and remove secrets before requests leave the application. Logs retain identifiers and audit metadata while full content receives a short retention period. If an application can use both the developer API and Vertex AI, routing must account for data location, IAM, service terms and security configuration—not price alone.
For tool use, validate JSON against a closed schema, reject extra fields and map logical actions to permissions outside the model. Sensitive parameters such as payment recipient, cloud project or production environment require contextual validation or human confirmation. The model may propose an operation but cannot define its authorisation rules.
Regression testing after model changes
Maintain a frozen suite with expected answers, evidence and permitted tools. After an update, inspect worst regressions as well as average quality: missing citations, incorrect calls, greater willingness to act and false refusals. Rollback should change a router version without rebuilding the application. This matters for managed models whose behaviour can evolve independently of client code.
Pair the rollout with LLM evaluation, browser-agent security and an LLM gateway. For an API/Vertex AI comparison and tool assessment, contact BreachRoad.
Primary source: Google — Gemini 3.1 Pro.
