Moonshot curbs Kimi K3.1 Pro's hacking skills — 81% on its cyber test after cyber data was filtered from training

• Moonshot AI said on Saturday, October 24, 2026 that it reduced the cyber-offensive capabilities of Kimi K3.1 Pro, its newest open-weight model — removing cyber-related data from the training corpus and reinforcement-learning environments while retaining general coding skills.
• The company's stated principle: “We aim not to release open weights that would extend the absolute frontier of cyber capability.” It also said it intends to progressively raise the cyber capability available in its open weights over time.
• On Moonshot's internal cyber benchmark — finding and exploiting software vulnerabilities in a controlled environment — K3.1 Pro scored 81.0%, versus 90.5% for a similar version without the risk-reduction measures. The results have not been independently verified.
• K3.1 Pro is described as Moonshot's most capable 3-trillion-parameter-class open-weight model with a 1-million-token context window; a faster K3.1 Pro Highspeed runs at two to three times the speed of the standard model. The weights are to be published by November 4.
• The announcement came eight days after China's Ministry of Commerce and Ministry of Science and Technology proposed new export controls (Announcement No. 48, October 16) that would ban exports of AI-driven malware-generation technology — open for public comment until November 15.

Moonshot AI said on Saturday that it deliberately reduced the cyber-offensive capabilities of Kimi K3.1 Pro, its newest open-weight model — removing cyber-related data from the training corpus and reinforcement-learning environments before it publishes the model's weights on November 4.

What Moonshot removed

Reuters reported from Beijing on October 24 that Moonshot stripped cyber-related material from both the mid-training data and the reinforcement-learning tasks used to develop K3.1 Pro, while keeping the general programming abilities that make the model useful for building and repairing software. “We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said. It also said it intends to progressively raise the cyber capability available in its open weights, so more teams can audit the code they maintain — legacy systems included — on infrastructure they control.

The numbers

On Moonshot's internal cyber benchmark, which tests finding and exploiting software vulnerabilities in a controlled environment, K3.1 Pro scored 81.0% — compared with 90.5% for a similar version built without the risk-reduction measures. The company said the comparison showed that filtering cyber-related data reduced the model's offensive cyber performance, although it still outperformed its predecessor. The results have not been independently verified.

On the harder xdev-bench-hard test (success measured within three attempts), K3.1 Pro “improves substantially over its predecessor, indicating that stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal,” Moonshot's blog says. K3 scored 33.3% on the same test; in Moonshot's comparison chart, DeepSeek V4.1-Flash scored 85.7% and a third-party evaluation of GPT-5.6 Sol scored 100.

Why now: export controls and a sharpening debate

The statement landed eight days after China's Ministry of Commerce and Ministry of Science and Technology proposed new technology export controls (Announcement No. 48, issued October 16) that would ban exports of AI-driven malware-generation and mutation technology and restrict AI-assisted vulnerability-discovery tools. The draft measures cite the risk that such capabilities could be used against critical infrastructure and defence systems; public comments close November 15.

It also lands in a heated argument about open weights. Anthropic published a report in late September arguing that Z.ai's downloadable GLM-5.3 posed a major cyberattack risk — mainly because anyone can download and modify it. On October 14, OpenAI CFO Sarah Friar told Bloomberg Television: “We think you want to be on more Western models on the cyber front.” Moonshot is making the opposite bet at the training-data level: curbing the capability up front rather than gating the weights.

What the curbs don't cover

Moonshot argues the other side of the case too: open-weight models can improve security by helping more organisations inspect and secure their own software, including older systems that receive little attention. But the limits of the approach are visible. The release blog does not address whether someone could fine-tune the released weights to put the filtered capability back. And unlike a hosted service, once the files are widely distributed by November 4, Moonshot has less ability to restrict access, monitor use or update safeguards.

The AI analysis site Extrapolator called the removal “the most uncertain claim in the release,” noting the boundary of what counts as “cyber-related” content is fuzzy by definition — a filtering heuristic rather than a principled capability boundary. Filtering training data is not the same as removing a capability; the November 4 weights will tell the research community how much of the gap survives contact with fine-tuning.

Availability

K3.1 Pro is already live in the Kimi apps, the Kimi Work desktop app from version 3.1.0, and Kimi Code, and through the API as kimi-k3.1-pro and kimi-k3.1-pro-highspeed — the faster variant runs at two to three times the speed of the standard model — with zero data retention available to API customers. Kimi Enterprise admins have to opt in, since access is off by default. Full weights are promised by November 4.