On October 23, Moonshot AI put a new flag in the ground: Kimi K3.1 Pro, which the company describes as its most capable 3T-class open-weight model to date, with a 1-million-token context window and a benchmark table that lands within a hair’s breadth of Claude Opus 5.5 on Terminal-Bench 4.0. Two days later, that table is still vendor-reported and already contested on Hacker News. But the more interesting part of the launch isn’t the benchmark chart at all. It’s a disclosure about what Moonshot deliberately removed from the model — dual-use cyber-exploit data stripped out of training, at a measured cost of about nine and a half points on its own exploit benchmark.
A launch that ships with subtraction attached is rare. Here’s what shipped, what it claims, and why the subtraction might be the real headline.
Kimi K3.1 Pro has landed
The facts first. Kimi K3.1 Pro is live today on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API. Moonshot also released Kimi K3.1 Pro Highspeed, a variant it says runs 2–3× faster for more responsive interactions. The model handles text and images, spans one million tokens of context, and is — critically — a post-trained version of Kimi K3 with substantially larger post-training compute: the launch post describes optimizing the RL framework, long-context inference, sandbox infrastructure, and rollout scheduling to run “large-scale joint RL across hundreds of downstream domains.”
If you want to try it through the API today, the launch post lists the model identifiers:
1 | # Platform model IDs, per Moonshot's launch post |
And then there’s the promise that gives this launch its shape: full model weights will be released by November 4, 2026. That’s a ~12-day runway between API availability and open weights. As of this writing, no K3.1 Pro repository appears on Moonshot’s Hugging Face org page — which currently lists the predecessor moonshotai/Kimi-K3 at 2.8 trillion parameters with roughly 910k downloads, updated September 2. The K3.1 Pro checkpoints still need to appear.
[UNVERIFIED: the license terms Moonshot will attach to the K3.1 Pro weights — the launch post text we reviewed does not specify a license, and the weights repo does not yet exist]
From K3 to K3.1: same base, a lot more post-training
Worth being precise about what “3T-class” means here. Moonshot’s blog calls K3.1 Pro a 3T-class model, but that’s a marketing-size term, not a precise parameter count — the actual dimensions are 2.8T (3T-class), as The Decoder notes in its review of the release: K3’s dimensions retained, at 2.8 trillion total parameters with 104 billion active ones. Either way: big, multimodal, and heavy on post-training.
The gains are agentic: coding across game engines (Unity, Unreal, Godot), 3D asset creation via BenchCAD scores, end-to-end financial workflows (state-of-the-art on OfficeQA Pro v2 at 64.4 by its own measurement), and a sharp drop in hallucination — claim-level hallucination rate on its internal Kimi Hallu Bench Hard fell from 23.4% for K3 to 8.3%, with a stress-test caveat attached, since it is Moonshot’s own internal bench. The long-horizon pitch comes through in vendor anecdotes too — in one internal simulator-building test, the model found and corrected 36 errors in its own physics code after reward shaping stalled. Impressive, unverified, and illustrative of the self-debugging pitch.
The benchmark claims — and why the footnote matters
The Kimi K3.1 Pro benchmark story needs a caveat before it needs a chart. Here’s the table-entry paragraph from Moonshot, hedged properly: Moonshot claims K3.1 Pro scores 65.7% on Terminal-Bench 4.0, evaluated with the Claude-Code harness, ahead of GPT-6 Astra (58.2%) and “narrowly behind Claude Opus 5.5 (66.4%).” K3, its predecessor, managed 13% on the same test per The Decoder’s recounting. That’s the “near-Opus” claim in its most quotable form.
But read the methodology footnote on Moonshot’s own blog, because it matters:
“Kimi K3.1 Pro is evaluated with the Claude-Code harness. … All remaining scores are taken as the maximum value reported in either their blog posts or the official Terminal-Bench 4.0 leaderboard.”
Maximum value reported anywhere. Moonshot’s table credits Opus 5.5 with 66.4% — the higher vendor-self-reported figure. But on the official Terminal-Bench 4.0 leaderboard, which we pulled directly for this post, Claude Opus 5.5 (max, Claude Code harness) sits at 64.8% ± 3.1%, dated September 22, 2026. The difference between 66.4 and 64.8 is the difference between a 0.7-point gap narrative and a 0.9-point one — either way inside the benchmark’s ±3.1% error bars. Honest summary: on the official leaderboard there is no K3.1 Pro row yet, so Opus 5.5 tops the board at 64.8% as the only one of the two with an entry. Mixing methodologies flips the nominal ordering: K3.1 Pro’s vendor-claimed 65.7% sits nominally 0.9 points above the official board’s 64.8% for Opus 5.5 — both within the ±3.1% error bars, and that comparison mixes a vendor claim against an official run. What the 65.7% figure can’t yet be is independently checked: the open weights don’t exist, so nobody can replicate Moonshot’s exact run the way they could replicate Anthropic’s. Independent measurement of the API model is another matter, though.
Independent evaluators have had a go at the API version, and the most pointed data point comes from Artificial Analysis: its Intelligence Index v4.3.2 explicitly incorporates Terminal-Bench 4.0 among its ten evaluations, with results measured independently by Artificial Analysis on its own harness — and AA’s comparison table puts K3.1 Pro at 67% against Opus 5.5’s 60%. K3.1 Pro scores 55 on the Artificial Analysis Intelligence Index — an 11-point jump over K3 — placing it fourth behind Claude Opus 5.5 (58), Claude Sonnet 5.5 (56), and Muse Wonder Full (56), according to The Decoder, citing Artificial Analysis. On GDPval-AA it posts 1,846 Elo versus Opus 5.5’s 1,866. And on ExploitBench, a cyber-capability benchmark, the gap is real: Kimi 74.7 versus Opus 91.0 and GPT-6 Astra at 100, per The Decoder’s relaying of Moonshot’s table.
Where the HN pushback lands
The main HN thread — 1,064 points, 655 comments at the time we read it — is doing exactly what HN threads should do: arguing about the tables.
- Benchmark saturation: a comment inside the main discussion (item 50212575) points to an analysis at preferencemodel.com arguing Terminal-Bench 4 is “closer to solved than its leaderboard” suggests — fine-grained rankings near the top tell you less than a 0.7-point gap implies.
- Distillation speculation: one commenter observed the model spontaneously referencing evaluator-approval and Moonshot-guidelines phrasing in its reasoning; another reported an internal UI-design benchmark showing K3.1 Pro’s designs jumping from 0.43 similarity to OpenAI’s models (for K3) to 0.58. Commenters split between distillation theories and the plausible alternative that every lab trains on transcript data floating around the internet. Nobody has proof either way.
- Astroturfing allegations: Simon Willison shared screenshots of Moonshot “creators campaign docs” that appear to brief influencers on boosting the model’s narrative, with only one secondhand confirmation. The comment section’s own fact-check found several viral claims didn’t survive contact with pricing and AA-index numbers. Treat circulating social-media superiority claims as marketing until you can reproduce them.
- Practical gripes: multiple commenters report brutal five-hour usage limits on consumer subscription plans. The API is a different story.
All of which is to say: the vendor-claimed half of the benchmark story is promising but contested. Artificial Analysis has already run the API model independently; the leaderboard row and the open-weights replication are still wait-and-see.
The real headline: an open-weights lab publishing its cyber-risk-reduction math
If the benchmark table is the noise, the cyber-risk-reduction disclosure is the signal in Kimi K3.1 Pro’s launch — and it’s the part no other open-weights release has matched. Moonshot devotes an entire section of its technical blog to cybersecurity, and it doesn’t read like a safety PR block. It reads like someone showing their work.
What was removed, and when
As post-training scaled up, Moonshot observed vulnerability-research performance improving steadily. Tracing the trend, they found cyber-related content “embedded within the general mid-training corpus, and cyber-related tasks were present in the RL environment mix — a natural byproduct of training on broad data.” In preliminary experiments on internal models, they found that without removal at either stage, downstream cyber capability “would increase substantially.”
So for the open-weight release of Kimi K3.1 Pro, they did two things: removed cyber-related data from the mid-training corpus, and filtered cyber-related tasks out of the RL environment mix, while keeping the general-purpose coding tasks needed for model usefulness. Not the whole corpus — one narrow slice, at two specific stages, with the useful general coding ability explicitly preserved.
The 90.5% → 81.0% number, precisely stated
Moonshot’s in-house benchmark, xdev-bench-hard, is where the delta gets measured. The task design is worth quoting in compressed form: expert-curated, source-code-based vulnerability discovery and exploitation tasks that “faithfully reproduce recently disclosed vulnerabilities” in software including the Linux kernel, Node.js, JavaScriptCore, Exim, and VirGL, with mitigations enabled. Each task hands the agent vulnerable source code, a short bug hint, and the corresponding binary; the agent must develop an exploit, achieve arbitrary code execution in a separate sandbox, and retrieve a secret string for automated verification. Scoring is pass@3, with no hard timeouts or output-token limits.
The result Moonshot reports: the checkpoint built without these measures — no cyber-data removal at mid-training, no cyber-task filtering in RL — solves 90.5% of problems at pass@3. The final K3.1 Pro, post-cleaning, solves 81.0%. The Kimi figures are Moonshot’s own runs on its own benchmark, not third-party audits — with one telling exception: the same chart’s top entry, GPT-5.6 Sol at 100, is explicitly captioned a third-party evaluation, so a non-Moonshot lab has already run this suite and scored a model above the 90.5% un-cleaned checkpoint. For context, the chart also places Kimi K3 at 33.3%, DeepSeek-V4.1-Flash at 85.7%, and GLM-5.3 at 57.1%.
Two things follow from that chart, and Moonshot states both candidly. First, the data removal “meaningfully reduces cyber capability relative to what the same training pipeline would otherwise produce.” Second — the uncomfortable part — K3.1 Pro still improves substantially over K3, because “stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal.” Filtering slows the climb; it doesn’t stop it.
Why this disclosure matters
Moonshot frames two open-weight principles. First: “we aim not to release open weights that would extend the absolute frontier of cyber capability” — K3.1 Pro’s offensive capability is, by design, below what its pipeline could produce, and it stays behind frontier proprietary models that have been publicly available for at least three months. Second: it intends to “progressively raise the cyber capability available in open weights,” on the argument that a capable model running on infrastructure users control lets more teams audit the code they maintain — including legacy systems that rarely get dedicated security reviews — and that diffusing this capability gradually beats concentrating it in a few proprietary systems.
Whatever you think of that argument, compare it to the standard alternative: silence. Here, an open-weights lab quantified — with a before/after number on a reproducible-sounding task suite — exactly how much capability it traded away for the release. The Decoder, covering the launch, drew the connection to Anthropic’s earlier finding that GLM-5.3 — which scores just 45 on the AA Index — can still write exploits at near-Claude-Mythos levels, raising the stakes on the generalization point Moonshot admits to — a capability-drift pattern familiar from our roundup of OpenAI misalignment incidents.
What “weights by Nov 4” changes for the frontier contest
The open-weights race has its own leaderboard now, and November 4 is a date on it. That matters because Kimi K3.1 Pro’s November weights are the artifact the whole disclosure above applies to. The Decoder’s math, from Artificial Analysis figures: if K3.1 Pro ships open weights at an AA Index of 55, it becomes the highest-scoring open-weights model available, shrinking the gap between open and proprietary models from 12 points to 3 — assuming nothing else moves in the meantime, which it always does.
It fits a pattern we’ve covered here before: DeepSeek’s V4.1 line, Tencent’s Hunyuan models, Mistral 3, GPT-6.1 Sol’s launch, and the GLM-5.3 generation of open-frontier Chinese models (prior reading: our DeepSeek V4.1 developer guide and DeepSeek V4.1 Flash vs Reflection Beam deep-dives, plus our Terminal-Bench 4.0 harness-methodology breakdown). Two deliberate scope notes for this post: no benchmark-comparison redo — that’s banked for a separate Kimi-vs-GLM run — and no contest framing. The subject is the policy, plus the model.
What’s genuinely different about the Nov 4 release — as far as we can tell, and we wouldn’t bet heavily on “first” — is that we know of no prior open-weight distribution of a model whose own lab has published capability it consciously removed. Whoever downloads these weights on or after November 4 is downloading a deliberately de-scoped artifact. That’s a new kind of object in the open-weights world: not just “open,” but open-with-a-stated-safety-ablation.
Why this disclosure may become the template — and the open questions
Two reasons this could normalize. One: the disclosure costs Moonshot almost nothing reputationally — it shows restraint and gives the launch a differentiator no benchmark table can. Two: the mechanics generalize. “We identified the dual-use slice of mid-training data and the RL environment mix, filtered both, and report the delta” is a template any lab can fill in with its own domain of concern — bio screening, whatever comes next.
But the open questions are the honest part of this story, and the HN thread raised most of them before the weights are even out:
- No external audit of the Moonshot numbers yet. The 90.5/81.0 numbers come from Moonshot’s own in-house benchmark, run on its own models. The chart does include one third-party run — GPT-5.6 Sol at 100, by an outside lab — but nobody has yet replicated the Moonshot numbers on the K3.1 Pro checkpoints themselves, and it’s unclear whether there will be.
- What does “removed” actually verify? Once weights ship, can a user distinguish a model that never learned exploitation patterns from one that had them scrubbed late? One commenter put it sharply: how much “cybersecurity data” is just standard software knowledge that exploits can be derived from? The counterpoint: models don’t learn from experience — whatever they know after training is all they’ll ever know — so un-trained capability is a real gap, not a fig leaf. Both can be true; the November weights will let researchers test which dominates.
- Does knowing less about security make models worse at it? Some commenters worried the inverse: a model with scraped-down security knowledge may write more insecure software. Moonshot explicitly kept “the general-purpose coding tasks needed for model usefulness” — but whether defensive capability survived the filter isn’t separately quantified in what we reviewed [UNVERIFIED: whether Moonshot separately measured defensive-cyber or secure-code-writing capability in the shipped model]. The launch post’s argument that open, locally-controlled models help defenders audit code is an argument, not a measurement.
- The sustainability problem. If “not releasing weights that extend the absolute frontier” becomes an industry norm, it invites the question of where the restricted-category line goes next — the Hogwarts-restricted-section objection commenters aired. What happens when the next dual-use domain is fuzzier than exploit code?
Bottom line for developers
- Try it now if you’re an API-first shop. Per Moonshot’s own pricing page (rates checked October 24, 2026),
kimi-k3.1-procosts $2/$10 per million tokens (input/output, cache hits $0.20) — down 33% from K3’s $3/$15 — with the Highspeed variant at $4/$20. Agentic coding and long-horizon work is where the gains show. - Wait for the weights if you’re benchmark-driven. The 65.7% Terminal-Bench figure is a vendor claim under a “max across sources” methodology. When the official leaderboard and independent harnesses get the open weights, run your own tasks.
- Watch the Nov 4 repo for the license and the disclosure’s fine print. Whether the open release includes the Highspeed variant is not specified in the launch post we reviewed [UNVERIFIED: whether weights due Nov 4 cover K3.1 Pro Highspeed as well as the standard model].
- File the disclosure template away if you work in AI policy or open-source governance. Quantified dual-use data removal at named training stages, with before/after numbers on an in-house benchmark, is the most concrete formula for this that any lab has published. The open question — can anyone besides the lab verify it? — decides whether this becomes a norm or an anecdote.
The benchmark headline writes itself: an open-weight model less than a point behind the proprietary frontier on the vendor’s own table. The story underneath it is more interesting: a lab that can tell you, to the decimal, what it chose not to build. Whether that second claim can ever be verified by outsiders is the question November 4 will start answering.
References and further reading
- Moonshot AI — Kimi K3.1 Pro launch post
- Moonshot AI — developer platform and pricing
- Moonshot AI on Hugging Face
- Terminal-Bench 4.0 official leaderboard
- Artificial Analysis — Intelligence Index v4.3.2
- The Decoder — Kimi K3.1 Pro coverage
- Hacker News discussion — 1,064 points
- preferencemodel.com — Terminal-Bench 4 saturation analysis
- Simon Willison on X
Please let us know if you enjoyed this blog post. Share it with others to spread the knowledge! If you believe any images in this post infringe your copyright, please contact us promptly so we can remove them.