Moonshot says it removed cyber-related training material from Kimi K3.1 Pro before its planned open-weight release. Reuters reported the decision on October 24. The unusual selling point is a capability the developer deliberately held back.
The model is already offered through Kimi’s services; the official API platform lists Pro and Highspeed with a million-token context window. The downloadable weights—the files needed to run and modify the model independently—are promised by November 4, rather than already available.
Kimi K3.1 Pro’s hacking test needs its fine print
In its technical account, Moonshot describes removing cyber data during mid-training and filtering cybersecurity tasks from reinforcement learning, while keeping general coding work. Its internal exploit benchmark scored the final model at 81.0%, against 90.5% for a checkpoint without those measures. The final model still outperformed Kimi K3.
Those figures measure a deliberately prepared test: the agent receives vulnerable source code, a bug hint and a binary, then tries to demonstrate code execution inside a sandbox. The score counts success within three attempts; the reported runs have no hard time or output-token limits. It is not an 81% chance of compromising an arbitrary website. Reuters says the results have not been independently verified.
The release changes who holds the controls
Moonshot argues broader access can help defenders inspect neglected software. Reuters highlights the corresponding tradeoff: once weights circulate, the developer has less ability to monitor users, restrict access or update safeguards centrally than with a hosted service.
The important limit is visible in Moonshot’s own account: better coding and extended debugging still transfer to cyber tasks after targeted data removal. Reducing a benchmark score does not establish that malicious use has been prevented.
For organizations considering the model, our assessment is to treat the release decision and their own deployment controls as separate questions. The November deadline concerns access to the files; it does not certify what every modified copy will do. Opening a model also moves responsibility toward whoever runs it.
