AI News
Kimi K3.1 Pro Launches With Its Hacking Skills Deliberately Removed
Beijing-based Moonshot AI introduced Kimi K3.1 Pro on October 24, describing it as its most capable open-weight model in the 3-trillion-parameter class, with the full model weights due by November 4. The unusual part of the launch is what the company took out: it deliberately reduced the model's cyber-offensive capabilities before releasing it, filtering cyber-related data from both the training corpus and the reinforcement-learning environments used to build it, while keeping its general coding skills intact. Moonshot's stated reason is blunt: "We aim not to release open weights that would extend the absolute frontier of cyber capability."
What was removed, and what the numbers show
Moonshot published its own before-and-after measurement. On an internal vulnerability-exploitation test, the filtered model scored 81.0%, against 90.5% for a version built without the curbs. That is still far above its predecessor Kimi K3, which scored 33.3% on the same test — and Moonshot's own chart puts DeepSeek-V4.1-Flash higher still, at 85.7%. The honest reading is that the curbs lowered the ceiling without removing the capability: an 81% exploit-test score is a capable model with a leash, not a harmless one.
The timing is not accidental. A week earlier, China proposed draft export controls that would ban exports of AI-driven malware-generation and mutation technology and restrict AI-assisted vulnerability-discovery tools, citing risks to critical infrastructure, defence-industrial systems and core government systems. The measures remain open for public comment. Moonshot's move reads as both a safety decision and a regulatory one: a company about to publish downloadable weights for its flagship model, in a week when its own government is writing rules about exactly that kind of capability.
What you actually get
Underneath the safety story, K3.1 Pro is a serious model. It is a mixture-of-experts design — 2.8 trillion parameters in total with 104 billion active per token, according to Artificial Analysis — with a 1-million-token context window, priced at $2 per million input tokens and $10 per million output tokens. A faster companion variant, K3.1 Pro Highspeed, delivers two to three times the speed with identical capabilities. Both are available across the Kimi product family — Kimi.ai, mobile apps, the Kimi Work desktop app, Kimi Code and the API, where they are listed as kimi-k3.1-pro and kimi-k3.1-pro-highspeed — with Zero Data Retention available for API customers.
On independent measurement, K3.1 Pro scored 55 on Artificial Analysis's Intelligence Index, landing fourth behind Claude Opus 5.5 (58), Claude Sonnet 5.5 (56) and Meta's Muse Wonder Full (56), and 11 points above Kimi K3. Artificial Analysis says it will be the top open-weight model once the weights are published, narrowing the gap to proprietary models to 3 points. On coding, Moonshot reports 65.7% on Terminal-Bench 4.0, close to Claude Opus 5.5's 66.4% — but that figure is vendor-reported, not independently verified.
The honest limits
Three caveats matter before anyone treats this as a download date. First, Moonshot has not specified the license, so calling the November 4 release open source would outrun the evidence — open weights are not the same as open source. Second, the model whose weights ship in November will differ from the hosted system that earned the launch scores, because the weights remove cyber-related data; the shipped model is a new evaluation target, not a file export of the tested one. Third, the internal exploit benchmark is unpublished and the results have not been independently verified, and earlier UK and US testing found K3 completing a simulated corporate network attack in one of ten attempts.
Moonshot's own argument for publishing anyway is worth hearing: open-weight models let more organisations inspect and secure their own software, including older systems that receive little attention. The counter-argument, which the company does not dispute, is that downloadable weights make central oversight harder once the file is out. Both are true, and November 4 is when the trade-off becomes concrete: the weights, the license, the hardware guidance and independent reproductions will show whether the access implied by this announcement is real.