Most model launches are a pricing email and a benchmark table. Kimi K3.1 Pro is a pricing email, a benchmark table, and a safety ablation, which is not something I expected from an open-weight release.
Moonshot shipped Kimi K3.1 Pro and Kimi K3.1 Pro Highspeed on October 23 (October 24 in China). It is a post-trained version of Kimi K3 with the same 2.8 trillion total and 104 billion active parameters, a 1,048,576 token context window, and a real price cut: $2.00 per million input tokens, $10.00 per million output, $0.20 per million cache hits, all 33 percent below K3 at $3.00, $15.00 and $0.30. The full weights are promised by November 4.
Then, between the CAD demos and the finance charts, there is a section titled Cybersecurity that contains a number almost no lab chooses to publish: the score of the model they decided not to ship.
🚀 The Launch Numbers, With Their Asterisks
Artificial Analysis puts Kimi K3.1 Pro at 55 on its Intelligence Index, fourth overall, up 11 points from K3 at 44. Only Claude Opus 5.5 (58), Claude Sonnet 5.5 (56) and Muse Wonder Full (56) sit ahead of it. If the weights land on schedule, that makes it the highest scoring open-weight model available and shrinks the gap between open and proprietary models from 12 points to 3.
On Terminal-Bench 4.0, Moonshot reports 65.7 percent with the Claude Code harness, ahead of GPT-6 Astra at 58.2 and 0.7 points behind Claude Opus 5.5 at 66.4. Artificial Analysis ran the same benchmark with its own harness and measured 67 percent, which it calls the highest score of any model. Kimi K3 scored 13 percent. Both figures can be true, and that is the point: on agentic coding benchmarks the harness is a bigger variable than the gap between the top three models.
On its own Kimi Hallu Bench Hard stress set, the claim-level hallucination rate drops from 23.4 percent to 8.3 percent, though GPT-6 Astra still scores better at 5.5 percent, and Artificial Analysis measures a 44 percent rate on its independent Omniscience eval. Vendor benches flatter, independent benches argue.
🔬 The Ablation Is The Actual News
Here is the part worth reading twice.
Moonshot says it noticed vulnerability research performance climbing steadily as post-training scaled. Tracing it, they found cyber content embedded in the general mid-training corpus and cyber tasks sitting in the reinforcement learning environment mix, a byproduct of training on broad data rather than something anyone aimed at. For the open-weight release, they removed cyber-related data from both stages while keeping general coding tasks.
Then they measured what that cost, on xdev-bench-hard: expert-curated tasks that reproduce recently disclosed vulnerabilities in the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL, mitigations enabled. Each task hands the agent vulnerable source, a short bug hint, and a binary. The agent has to develop an exploit, get arbitrary code execution in a separate sandbox, and pull a secret string to prove it. They report pass@3 with no timeouts and no output token limit.
The checkpoint without the risk-reduction measures solves 90.5 percent of those problems. The model they are actually shipping solves 81.0 percent. Kimi K3, six weeks of post-training ago, managed 33.3 percent.
Everyone publishes evals of what they shipped. Almost nobody publishes the eval of what they chose not to ship, because it is a confession with a number attached. That is what this is: a control group. The intervention was real, and the price was 9.5 points on a benchmark nobody outside Moonshot can run.
That last clause is the caveat. xdev-bench-hard is internal, calibrated in their words to differentiate at their current capability level, run on a random subset with pass@3. The tasks are real bugs with real mitigations, but neither the dataset nor the harness is public. The claim that K3.1 Pro’s offensive capability “remains behind frontier proprietary models that have been publicly available for at least three months” is a claim, not a measurement you or I can check. The numbers are disclosed. The margin they imply is asserted.
⚖️ What 81 Means When Anyone Can Download It
The 90.5 percent model does not exist outside Moonshot’s cluster and never will. The number that exists in the world on November 4 is 81.0, and that is the one to plan around.
It also is not the open-weight ceiling. According to The Decoder’s reading of Moonshot’s benchmark table, DeepSeek-V4.1-Flash scores 85.7 on the same xdev-bench-hard, higher than the version of Kimi that just got cleaned. DeepSeek-V4.1-Flash-1017 is on Hugging Face under the MIT license, 763 billion parameters, downloadable today. Stripping cyber data out of Kimi did not lower what anyone can put on a GPU.
Anthropic’s Frontier Red Team measured where open weights actually sit three weeks earlier, and it is worth reading next to this launch. On ExploitBench, 41 known Chrome V8 bugs, GLM-5.3 built a working end-to-end exploit in 50 of 410 attempts. Claude Mythos Preview, which Anthropic only releases to vetted defenders through Project Glasswing, managed 56 of 410. Kimi K3 and DeepSeek V4.1-Flash were at or near zero. NIST’s CAISI separately called GLM-5.3 the most cyber-capable open-weight model released to date and put it about four months behind the US frontier.
I am not lining those numbers up against Moonshot’s. Anthropic measures the share of attempts that produced a working exploit; Moonshot’s table, transcribed by The Decoder, shows 74.7 on ExploitBench, a pass@5 score counting how many of 16 capability flags a run reached in 300 turns. Same name, incompatible scoring.
The scope Moonshot claimed is narrow, and it stated it narrowly: not to release weights that extend the absolute frontier of cyber capability. It did not claim to pull the open-weight frontier down, and it did not. The reading that a hacking model got nerfed is the wrong story twice over.
🔓 Data Removal Is The Control That Survives A Download
Anthropic’s companion finding in that same report is that refusal training does not survive an open-weight release. GLM-5.3 shipped with refusals, standard techniques got past them 64 to 100 percent of the time in Anthropic’s tests, and abliteration removed them outright. Abliterated builds were public within days, and Anthropic estimates an experienced team starting from scratch needs about 600 GPU hours, roughly $1,200. That is not a safety control. That is a speed bump with a published price.
Removing data is a different class of control, because you cannot abliterate back a capability that was never trained. Getting those 9.5 points back means having the corpus and paying for the post-training compute, which is the expensive half of the pipeline. This is the strongest version of the argument that open weights can be steered at training time rather than at the API edge, and it is testable, which is more than most safety claims in this space manage.
It also comes with an honest bill: 9.5 points of exploit skill, and a legible recipe. Moonshot said which stages carried the capability, mid-training corpus and RL environment mix, and published what removing it bought. A disclosed ablation is a disclosed control knob.
📦 What I’d Do Before November 4
Do not plan to self-host this. A 2.8 trillion parameter mixture of experts is a cluster exercise, not a workstation one, and the download is a multi hundred gigabyte event before anyone quantizes it. What arrives quickly is the derivative layer: quantized builds, distills, and fine-tunes that inherit the coding behavior and most of the agentic ability.
On the API, price by task, not by token. Artificial Analysis measures $1.98 per Intelligence Index task against $2.00 for K3, because the model emits 55K output tokens where K3 used 48K, 14 percent more. A 33 percent token cut and a flat per task cost are the same sentence. Highspeed is two to three times faster at double the rate, $4.00 in and $20.00 out, so it is a latency purchase and not a cheapness one.
The use I care about is boring and defensive: pointing an agent with a 1M token window at a service that has not had a security review since it was written, and letting it read the whole thing. That is the case Moonshot makes for shipping the weights at all, and it is a good one.
The thing to stop doing is treating exploit-capable coding agents as a future risk. GLM-5.3 has been downloadable since August, and CAISI and Anthropic both say it can build end-to-end exploits. Kimi sitting out the frontier changes nothing about what is on Hugging Face right now. If you run a SOC, your patching SLA is already competing with a model that turns a public CVE into a working chain for about $20 in API time.
🧠 Final Thoughts
The headline is that Moonshot nerfed its own hacking model. The story is that it priced the nerf: 90.5 down to 81.0 on its own bench, published next to the model it shipped, with the method described well enough that you can see where the lever is. That is the first time an open-weight release has handed me a number for a safety trade-off instead of an adjective.
It is also a smaller gesture than it looks. The 90.5 percent checkpoint is not downloadable, the open-weight cyber frontier was already set by another vendor in August, and 81.0 percent on a hard exploit bench is not a comfortable place to land. What Moonshot proved is narrower: training-time data control is the one intervention that survives a weight release, and it costs about 9.5 points to buy.
Read the ablation, not the headline. Then look at your patch SLA and decide whether it was written for a world without downloadable exploit agents.
Thanks for reading.