Moonshot trimmed Kimi K3.1 Pro’s hacking skill before opening the weights

Moonshot AI has released Kimi K3.1 Pro and says it removed cyber-related data from training so the model does not push the frontier of offensive hacking. On the company’s own test, the change cut its score from 90.5% to 81.0%. Reuters reported the move amid growing fears of AI-powered cyberattacks.

What Moonshot changed in training

According to Moonshot’s launch post, the company found that cyber-related content was embedded in its general mid-training corpus. It removed that material from both mid-training and reinforcement learning for the model it plans to publish as open weights. Moonshot states the goal as not releasing open weights that would extend the absolute frontier of cyber capability, and says it will keep applying controls at each training stage.

The effect is measured on xdev-bench-hard, an internal benchmark (pass@3). Moonshot’s table shows a checkpoint without the risk reduction at 90.5, K3.1 Pro at 81.0, DeepSeek-V4.1-Flash at 85.7, GLM-5.3 at 57.1 and the earlier Kimi K3 at 33.3. A third-party evaluation of GPT-5.6 Sol scored 100. Moonshot says K3.1 Pro’s cyber capability remains behind that of frontier proprietary models.

A 3T-class model with a 1M-token window

K3.1 Pro is the first model in the K3.1 series. It has a 1 million token context window, and a Highspeed variant runs two to three times faster. API model IDs are kimi-k3.1-pro and kimi-k3.1-pro-highspeed. It is available in Kimi.ai, the iOS, Android and HarmonyOS apps, Kimi Work, Kimi Code and the API, where Zero Data Retention is offered. Enterprise administrators must switch it on; it is off by default at launch. Full weights are due by November 4, 2026, and the post does not state the license.

Moonshot reports 65.7% on Terminal-Bench 4.0, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra, and 64.4 on OfficeQA Pro v2, which it calls state of the art. It also says the claim-level rate on its hard hallucination stress test fell from 23.4% for K3 to 8.3%, while cautioning that this is not an everyday error rate. These are the company’s own results, not independently verified.

What to watch before the weights ship

The fine print matters because the cyber figure is internal. Moonshot did not publish how xdev-bench-hard is built, so the 9.5 point drop is hard to judge from outside. The Decoder adds a second data point: on ExploitBench, K3.1 Pro scored 74.7%, well behind Claude Opus 5.5 at 91.0% and GPT-6 Astra at 100%. That fits the claim that it trails proprietary models, but it also shows the gap is large only against the top systems; DeepSeek-V4.1-Flash scores higher than K3.1 Pro on Moonshot’s own table.

The Decoder also reports Artificial Analysis placing the model fourth on its Intelligence Index at 55 points, behind Claude Opus 5.5 at 58 and Claude Sonnet 5.5 and Muse Wonder Full at 56. It lists pricing of $2.00 per million input tokens and $10.00 per million output tokens, down from $3 and $15, with Highspeed at $4.00 and $20.00. Generalist ability appears to have survived the data removal, which is what Moonshot says it wanted to preserve.

Three things will test the claims. First, whether the weights arrive by November 4 and under what license. Second, whether outside researchers reproduce the cyber scores on the released files; Moonshot’s own no-removal checkpoint is not part of the plan to publish. Third, whether others can restore the skill. The post does not say whether fine-tuning the open weights could bring offensive capability back, and that question is not addressed in the sources reviewed.