Notes from Việt Nam on law, technology, languages, history, culture and travel.

Trained Out on Purpose: Moonshot's Kimi K3.1 Pro Drops Cyber Data Before Opening Its Weights

Open-weight model releases usually compete on one thing: how close they get to the closed frontier. Kimi K3.1 Pro, which Moonshot AI released on 23 October 2026 (24 October in Asian time zones), does that, but it also does something less common. In its technical blog, Moonshot says it deliberately removed cyber-related training data to keep the model’s exploit-writing ability below the frontier before the weights go public. The company is giving up some capability on purpose and publishing the numbers that show how much.

What was released

According to Moonshot’s announcement and coverage from SiliconANGLE, Unite.AI and the ANI wire:

  • Two variants: K3.1 Pro and K3.1 Pro Highspeed. Moonshot says the second model has identical capabilities and runs 2–3× faster. No independent latency figures exist yet.
  • Context window: 1 million tokens. In Kimi Code, the full 1M window is limited to higher-tier plans.
  • Where it runs: Kimi.ai, the Kimi apps, the Kimi Work desktop app, Kimi Code (via /model), and the Kimi API under the model IDs kimi-k3.1-pro and kimi-k3.1-pro-highspeed.
  • Weights: Moonshot says the full weights will be published “by Nov 4”. No license has been announced. K3 shipped under a custom license, not an OSI-approved one.
  • Pricing: Moonshot’s blog does not list prices. Third-party coverage reports $2 input / $10 output per million tokens, a third cheaper than K3’s $3 / $15. Pricing aggregators confirm the K3 figure, but I could not confirm the K3.1 figure on Moonshot’s pricing page, so treat it as reported.

What is actually new

K3.1 Pro is not a new base model. Moonshot calls it “a post-trained version of Kimi K3, with substantially larger post-training compute”, with reinforcement learning across “hundreds of downstream domains”. The headline parameter count varies by outlet. Moonshot itself says only “3T-class”, while its Kimi Code docs put K3 at 2.8T. One analysis reports roughly 104B active parameters per token in a sparse mixture-of-experts design, but Moonshot has not confirmed that figure.

That makes this release a test of how much can still be gained by spending more on post-training alone. The figures Moonshot reports:

  • Terminal-Bench 4.0: 65.7%, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. Moonshot ran K3.1 Pro inside the Claude Code harness and took competitors’ scores from their own reports.
  • Kimi Code Bench 3.0 (long-horizon): 61.2%, up from 55.95% for K3. This is an internal benchmark.
  • BenchCAD (3D modelling via code, with tools): 92.7%, behind Opus 5.5 at 96.2% and GPT-6 Astra at 95.9%. Some coverage left out the “with tools” qualifier and that ranking.
  • Hallucination: on Moonshot’s internal “Hallu Bench Hard”, the claim-level error rate with tools fell from 23.4% (K3) to 8.3%. That beats Opus 5.5 (15.0) on this test but trails GPT-6 Astra (5.5). Moonshot notes that these stress-test numbers “do not represent overall error rates in daily use”.

The Artificial Analysis Intelligence Index, the only third-party number so far, reportedly puts K3.1 Pro at 55. That is 11 points above K3 and 3 below Opus 5.5.

For developers there are two practical details in the Kimi Code docs. K3.1 Pro runs only in thinking mode: a request with thinking disabled returns HTTP 400. And a mistyped model ID silently falls back to K2.8 Preview without thinking. If an evaluation pipeline has a typo, it could benchmark the wrong model without any error.

The cyber decision

This is the part worth reading closely. Moonshot writes that as post-training scaled, the model’s vulnerability-research performance “improved steadily”. The cause was not deliberate: cyber content was mixed into the general mid-training corpus, and cyber tasks were in the RL environment mix, “a natural byproduct of training on broad data”. The company says its preliminary experiments showed that without intervention, downstream cyber capability “would increase substantially”.

So for the open-weight release, Moonshot says it “identified and removed cyber-related data from both training stages” and kept the general coding tasks. On its internal xdev-bench-hard (expert-curated source-code exploitation tasks, pass@3), a checkpoint trained without these measures scored 90.5%, and the released model scores 81.0%. K3 scored 33.3% on the same chart. So even after the removal, K3.1 Pro is far more capable at exploitation than its predecessor.

Moonshot frames this as a policy with two principles: do not release open weights that “extend the absolute frontier of cyber capability”, and “progressively raise” the cyber capability available in open weights over time, so that defenders can audit legacy code that never gets a dedicated security review. It says K3.1 Pro’s cyber capability stays behind frontier proprietary models that have been public for at least three months.

Why it matters

Until now, open-weight safety has mostly meant refusal tuning, which fine-tuning can strip off within hours of release. Filtering data before training is harder to undo, because the capability was never fully learned. It is the approach that AI-safety researchers have pushed for some time, and it is unusual to see a Chinese frontier lab adopt it publicly and publish a before/after number. It also comes in a month when AI-found exploits have become a practical concern for anyone running PHP, ConnectWise or similar infrastructure.

Pricing matters too. If the reported $2 / $10 holds, it matches what newsletters list for Google’s Gemini 4 Argon and OpenAI’s latest Sol tier. That would put a model with open weights, within a point of Opus 5.5 on an agentic terminal benchmark, at mainstream frontier prices, with self-hosting as an option from November.

Open questions

  • Nearly every number is self-reported, and several benchmarks are Moonshot’s own (Kimi Code Bench, Hallu Bench, xdev-bench-hard). The harnesses also differ: Moonshot ran its model in Claude Code and took competitors’ scores from their blogs.
  • 81% is still a lot. A 9.5-point reduction on an internal exploit benchmark shows the filtering did something, not that the model is safe. Whether “behind proprietary models from three months ago” is a meaningful safety bar is a policy judgement, not a measurement.
  • Scope of the removal. Moonshot describes the data removal in the context of the open-weight release. It does not say whether the hosted API model went through the same filtering.
  • Can it be fine-tuned back? Data filtering raises the cost of restoring a capability, but a 3T-class base model with general coding skill and a modest fine-tuning set may recover much of what was removed. Expect researchers to test this within weeks of 4 November.
  • License and hardware. Without a license, nobody can yet plan commercial use. Running a model of this size needs well over a terabyte of GPU memory, so most developers will meet K3.1 Pro through an API, open weights or not.

Sources