Moonshot AI Launches Kimi K3.1 Pro and Deliberately Limits Its Hacking Skills Before Open Release
Moonshot AI introduced Kimi K3.1 Pro on October 24, 2026, the first model in its new K3.1 series and what the Beijing company calls its most capable 3T class open-weight model to date. The launch stands out for two reasons: the model is positioned close to leading proprietary systems on coding benchmarks, and Moonshot deliberately reduced its cyber-offensive capability before promising to publish its weights by November 4, 2026.
Open-weight models differ from closed, hosted systems in one practical way. Once the weights are published, outside developers can run and modify the model on their own systems. That openness can broaden access to advanced AI, but it also makes central oversight harder, because the original developer has less ability to restrict access, monitor use, or update safeguards after the files are widely distributed.
What Moonshot released
Kimi K3.1 Pro is a post-trained version of Kimi K3, built with what Moonshot describes as substantially larger post-training compute. The company said it optimized its reinforcement learning framework, long-context processing, and training efficiency to improve performance across coding, autonomous tasks, and knowledge work. The model has a 1-million-token context window, which allows it to work with very large amounts of text in a single session.
Moonshot also released Kimi K3.1 Pro Highspeed, a faster variant that runs at two to three times the speed of the standard model with identical capabilities. Both models are available on Kimi.ai and the Kimi mobile apps for iOS, Android, and HarmonyOS; on the Kimi Work desktop application, version 3.1.0 or later; in Kimi Code, where users select the model with the /model command; and through the Kimi API, where they are listed as kimi-k3.1-pro and kimi-k3.1-pro-highspeed. Zero Data Retention is available for API customers, and Kimi Enterprise administrators can enable K3.1 Pro with access off by default at launch.
Reported performance, with an important caveat
The benchmark figures below come from Moonshot and have not been independently verified, so they should be read as company-reported results rather than settled measurements. On Terminal-Bench 4.0, which evaluates coding agents on terminal-based tasks, Kimi K3.1 Pro scored 65.7 percent, ahead of GPT-6 Astra at 58.2 percent and narrowly behind Claude Opus 5.5 at 66.4 percent. On Kimi Code Bench 3.0 Long-horizon, an internal benchmark covering multi-step execution and tool use, K3.1 Pro scored 61.2 percent, compared with 55.95 percent for K3.
On Kimi Hallu Bench Hard, an internal stress test for factual accuracy, the claim-level hallucination rate fell from 23.4 percent for K3 to 8.3 percent for K3.1 Pro. That evaluation is deliberately crafted to probe error-prone situations, and the reported rates do not represent overall error rates in daily use. Independent analysis adds one more data point: Artificial Analysis gave Kimi K3.1 Pro a score of 55, ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon, each at 53, and behind only Claude Opus 5.5 at 58.
The deliberate safety tradeoff
The most unusual part of the launch is what Moonshot removed. The company said vulnerability-research performance improved as post-training scaled, and it traced the trend to cyber-related content in the general training corpus and cyber-related tasks in the reinforcement learning environment mix. For the open-weight release, it removed cyber-related data from both training stages while retaining the general-purpose coding tasks needed for model usefulness.
Moonshot stated its aim plainly: “We aim not to release open weights that would extend the absolute frontier of cyber capability.” On xdev-bench-hard, the company’s in-house benchmark of vulnerability discovery and exploitation tasks, a checkpoint trained without those risk-reduction measures solved 90.5 percent of problems, while the final K3.1 Pro reached 81.0 percent. Those results have not been independently verified. Moonshot also said K3.1 Pro’s cyber capability remains behind that of frontier proprietary models publicly available for at least three months.
The timing matters. China proposed export controls last week that would ban exports of AI-driven malware-generation and mutation technology and restrict AI-assisted vulnerability-discovery tools. The draft measures remain open for public comment and cite the risk that such capabilities could be used against critical infrastructure, defence-industrial systems, or core government systems, or to bypass security protections. Moonshot argued that open-weight models can improve security by helping more organizations inspect and secure their own software, including older systems that receive little attention.
Why it matters
For developers and tool builders, the practical question is whether a near-frontier model they can run themselves changes what they can build. A 1-million-token context window, strong reported coding results, and availability through Kimi.ai, Kimi Code, and an API give teams several ways to try the model before the weights arrive. If the November 4 weights release happens on schedule, researchers and smaller teams will be able to study, adapt, and deploy the model without depending on a hosted service.
For the wider AI industry, Moonshot’s safety choice may be just as consequential as its benchmark scores. Moonshot is trying a middle path, publishing a powerful model while deliberately holding back one class of capability. Whether other labs follow that approach, and whether researchers find the tradeoff credible once the weights are public, will shape how open models are released. Delivery on November 4 will be the real test.
