Kimi K3.1 Pro: Moonshot AI Curbs Hacking Ability Ahead of Open-Weights Release

Kimi K3.1 Pro: Moonshot AI Curbs Hacking Ability Ahead of Open-Weights Release

by | Oct 24, 2026 | Web3 Security

Moonshot AI said on Saturday, October 24, 2026, that it deliberately weakened the hacking skills of Kimi K3.1 Pro, the most advanced system the Beijing startup has built, by pulling cyber-related material out of the training process before release. The company said the change costs the model only a modest slice of its offensive capability, according to Crypto Briefing.

The decision matters because Moonshot plans to publish the model's weight files, reportedly by November 4, 2026, which would make Kimi K3.1 Pro the highest-scoring open-weights model available. Few Chinese labs have publicly acknowledged deliberately shaping a model's offensive-security ability, and Moonshot connects that choice directly to the planned release of the weights.

What Moonshot Removed and Why

The company said it scrubbed cyber-related material from two stages of development: the training corpus and the reinforcement-learning environments, while keeping general coding skills in place. Moonshot said its engineers traced steadily improving vulnerability-research performance to cyber-related content embedded in the general mid-training corpus and to cyber-related tasks in the reinforcement-learning mix, then identified and removed that data from both training stages for the open-weight release.

The approach sits earlier in the pipeline than the refusal filters that dominate public safety discussion of language models. Rather than training a fully capable model and then teaching it to decline malicious requests, Moonshot changed what the model learned from in the first place. The company said it stripped cyber tasks from the reinforcement-learning environments, which targets agentic skill rather than raw knowledge, and said it kept general coding capabilities, suggesting a narrow filter rather than a blanket purge.

Moonshot framed the work as a way to avoid releasing open weights that would extend the absolute frontier of cyber capability. The company does not present the model as harmless for security work; its narrower pledge is that Kimi K3.1 Pro will not rank as the most capable publicly available tool for attacking software. Moonshot said the model's cyber skills still trail those of top proprietary systems that have been on the market for three months or longer.

According to Crypto Briefing, the company said its goal is for this model not to advance the boundaries of cyber-offensive capability, with incremental improvements to defensive safeguards planned for future releases.

The 81.0% Figure and Its Limits

On an internal test of finding and exploiting software vulnerabilities, the released model reached 81.0%, while a comparable build trained without the risk-reduction measures reached 90.5%, according to Reuters and The Information. Moonshot ran its released configuration and the unfiltered version, then compared the scores.

The benchmark, which Moonshot calls xdev-bench-hard, consists of expert-curated, source-code-based vulnerability discovery and exploitation tasks, with scores measured at pass@3, according to Unite. Moonshot said the gap between the two builds demonstrates that removing the data cuts cyber capability well below what the same training pipeline would otherwise deliver.

All of the figures behind the claim are self-reported, and no outside party has verified them. Moonshot designed the test, chose the environment, ran both versions and reported the scores. A fair test of the 81.0% claim would need independent researchers to evaluate the released model on exploit tasks of their own choosing, in a setting Moonshot did not construct.

The filtered model still represents a large jump over its predecessor. Reports on the company's comparison put the earlier Kimi K3 at 33.3% on the same test, and The Decoder reported that DeepSeek-V4.1-Flash reaches 85.7%. Moonshot said Kimi K3.1 Pro outperformed K3 despite the filtering, and that it retained general coding strength.

A Stronger Model Underneath the Curbs

Kimi K3.1 Pro is a post-trained version of Kimi K3, built with what Moonshot describes as substantially larger post-training compute. The company describes it as its most capable 3T-class open-weight model to date, with a context window of 1 million tokens. The Decoder reported the model matches K3 in size, at 2.8 trillion total parameters with 104 billion active.

On Terminal-Bench 4.0, which evaluates coding agents on realistic, resource-constrained terminal tasks, K3.1 Pro scored 65.7%, ahead of GPT-6 Astra at 58.2% and narrowly behind Anthropic's Claude Opus 5.5 at 66.4%, according to Unite. Crypto Briefing noted the result places an open-weights Chinese model alongside a top closed US system on that benchmark.

The model jumped to fourth place on the Artificial Analysis Intelligence Index with 55 points, just behind Claude Opus 5.5, according to The Decoder. Moonshot also reported a top score of 64.4 on OfficeQA Pro v2, a test of complex fiscal data analysis using real financial documents, and said the model's claim-level hallucination rate on an internal stress test fell from 23.4% for K3 to 8.3%.

Moonshot also released a faster companion variant, Kimi K3.1 Pro Highspeed, which the company said delivers two to three times the standard model's speed with identical capabilities. The model is live on Kimi.ai, Kimi Work, Kimi Code and the Kimi API, with pricing of $2.00 input and $10.00 output per million tokens, according to MarkTechPost. Kimi Enterprise administrators can enable K3.1 Pro for their organizations, with access off by default at launch, according to Unite.

Pressure Behind the Decision

The announcement did not arrive in a vacuum. Concern is rising among governments, tech firms and security researchers that AI could lower the cost and difficulty of sophisticated hacking, according to The Economic Times. Against that backdrop, a lab announcing cyber curbs in a model reads as a response to pressure rather than an isolated gesture.

The decision also comes after Kimi K3 attracted scrutiny for how well it handled cyber tasks. Crypto Briefing described the new release as partly an answer to that attention, an effort to demonstrate that Moonshot can ship a more capable model without distributing a more dangerous attack tool.

Moonshot competes with closed Western labs and with other Chinese open-weights developers, and its filtering experiment adds a new axis to that competition: how much risk a model carries once released. The company's approach stands out because it still works after weights go public, unlike refusal-based safeguards that can be stripped from an open model. Moonshot has effectively volunteered a disclosure that competitors will feel pressure to match or explain away.

What Comes Next for Kimi K3.1 Pro

If Moonshot releases the weights as planned by November 4, 2026, researchers and security teams will be able to test the company's claims independently. Once weights are public, a user with modest hardware and a security dataset could also try to rebuild some of what Moonshot removed, which limits how much any training-time filter can guarantee.

Moonshot will have to show that the 81.0% score leaves enough room for legitimate use. If the company's claim holds, people who use the model for ordinary programming should see little change. The commercial effect of the announcement is hard to size, since the sources give no revenue or usage figures for the model beyond its API pricing.

The company's stated goal is narrower than making the model safe: it is to avoid extending the absolute frontier of cyber capability. That phrasing assumes a frontier that holds still, and it does not, so defenders cannot wait for a verdict on Kimi K3.1 Pro before adjusting their own posture.

Conclusion

Moonshot AI has released Kimi K3.1 Pro with cyber-related data deliberately removed from both its training corpus and reinforcement-learning environments, a trade the company says cut internal exploit-test performance from 90.5% to 81.0% while leaving general coding strength intact. All of the figures are self-reported and unverified. The next concrete step is the planned open-weights release, reportedly by November 4, 2026, which would let outside researchers test the claims on tasks and in environments Moonshot did not control, and would make the model the highest-scoring open-weights system available if the release proceeds as planned.

Frequently Asked Questions

What did Moonshot AI remove from Kimi K3.1 Pro?

Moonshot AI said it removed cyber-related data from both the training corpus and the reinforcement-learning environments used to develop Kimi K3.1 Pro, while retaining general coding skills. The company said it traced improving vulnerability-research performance to cyber content in those training stages and stripped it out for the open-weight release.

How much did the filtering cut Kimi K3.1 Pro's hacking ability?

On Moonshot's internal benchmark of vulnerability discovery and exploitation tasks, Kimi K3.1 Pro scored 81.0%, versus 90.5% for a similar version trained without the risk-reduction measures, according to Reuters and The Information. The earlier Kimi K3 scored 33.3% on the same test. All figures are self-reported and not independently verified.

When will Kimi K3.1 Pro's open weights be released?

Moonshot reportedly planned to publish the model's weight files by November 4, 2026. If the release proceeds as planned, Kimi K3.1 Pro would become the highest-scoring open-weights model available, and outside researchers would be able to test Moonshot's safety claims independently.

How does Kimi K3.1 Pro perform on coding benchmarks?

On Terminal-Bench 4.0, K3.1 Pro scored 65.7%, ahead of GPT-6 Astra at 58.2% and narrowly behind Claude Opus 5.5 at 66.4%, according to Unite. The model also reached fourth place on the Artificial Analysis Intelligence Index with 55 points, according to The Decoder.

How much does Kimi K3.1 Pro cost to use?

Pricing for K3.1 Pro is $2.00 per million input tokens and $10.00 per million output tokens, according to MarkTechPost. The model is live on Kimi.ai, Kimi Work, Kimi Code and the Kimi API, and a faster Highspeed variant runs at two to three times the speed with identical capabilities.

Sources