Moonshot AI has put numbers on a difficult model-release decision. Its Kimi K3.1 Pro announcement compares a checkpoint trained without targeted cyber restrictions with the final model, after cyber-related data and tasks were removed. Success on its internal exploit benchmark fell from 90.5% to 81.0%, while the model retained substantial coding capability. The company plans to release the weights by 4 November.[1]
K3.1 Pro is available through Kimi’s products and API with a one-million-token context window. The company describes a faster Highspeed variant as two to three times faster. Downloadable weights are promised by 4 November 2026; the hosted launch and planned weight release are separate milestones.[1]
Removing the lesson without removing the skill
Moonshot says cyber-related material had entered general mid-training data and reinforcement-learning tasks. As the model improved at ordinary programming, it also improved at offensive vulnerability research. To reduce that dual-use capability, engineers identified and removed relevant material from both stages of training. Crucially, they retained general coding tasks, because a model incapable of examining software would be less useful for programming, debugging and defensive security. The resulting tension is visible in the evaluation numbers.[1]
On xdev-bench-hard, the unrestricted checkpoint solved 90.5% of tasks at pass@3; the final K3.1 Pro reached 81.0%, a difference of 9.5 percentage points. Pass@3 allows up to three attempts. The developer’s test supplies vulnerable source code, a short hint and a binary, with no hard time or output-token limit. Those conditions define the result: it measures performance in a prepared exploit-development environment, not the rate of successful attacks against arbitrary live systems.[1]
The benchmark itself is a consequential limitation. It is designed and reported by the developer, with choices about what counts as a task, what assistance is provided and what qualifies as success. Outside researchers need enough detail to reproduce or challenge the comparison. Software vulnerabilities also come in diverse forms. A training intervention that affects one class of exploit development may leave other classes relatively untouched, and tool-using agents can combine model reasoning with external utilities in ways a single-model benchmark does not measure.[1]
Openness makes the safety claim testable—and contestable
There is a genuine public-interest argument for models that defenders can inspect and run locally. Small organisations may be unable to send proprietary software to a third-party hosted security service; an open model could help review code without exporting it. Researchers might test biases and failure modes without reliance on a single company's interface. But distributing weights also means later fine-tuning and integration choices can change how a model behaves. A safety limit engineered during initial training is not the same as a permanent restriction on every derivative.[1]
Moonshot presents its approach as a principle of staged openness: avoid releasing weights that extend the absolute frontier of offensive cyber capability while retaining useful general capabilities. Whether that principle holds depends on credible external tests, comparisons with already available systems and evidence about how capabilities change after release. The number a provider publishes today may cease to describe the systems people build tomorrow. This is especially true in security, where the relation between a model's raw knowledge and a coordinated agent's effectiveness is not fixed.[1]
The announcement makes a specific trade-off visible: less offensive capability than Moonshot’s unrestricted training pipeline produced, with much of the underlying skill retained. The planned weight release will let outside researchers test how that balance changes when the model is adapted or connected to other tools.[1]
Sources & further reading
- Introducing Kimi K3.1 Pro Moonshot AI · 23 Oct 2026 · Accessed 26 Oct 2026