Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Illustration: a glowing lattice model core split in two, one side orderly blue-green, the other dimmed and fragmented, with a silhouetted figure looking up

Moonshot Deliberately Limits Kimi K3.1 Pro’s Hacking Skills Before Open-Weight Release

by

In brief

  • Moonshot cut cyber training data from Kimi K3.1 Pro before its Nov. 4 open-weight release, lowering its internal cyber score to 81%. Here is what changed.
  • Moonshot announced Kimi K3.1 Pro on October 24, 2026, and plans to release its full model weights by November 4, 2026.
  • The company removed cyber-related data from the training corpus and filtered cyber tasks from reinforcement learning environments, while keeping general coding ability.
  • On Moonshot’s internal cyber benchmark, the final model scored 81%, versus 90.5% for a version built without the risk-reduction steps — company-reported figures that have not been independently verified.
  • Once weights are public, they cannot be recalled, which is why defenders and attackers are reading the same announcement in very different ways.

What did Moonshot actually change in Kimi K3.1 Pro?

Moonshot changed what the model was taught, not just what it is allowed to say. The Beijing company announced Kimi K3.1 Pro on October 24, 2026, and said it identified and removed cyber-related data from both training stages: the general training corpus and the reinforcement learning environments used in post-training. General coding tasks were kept, so the model remains a strong coding system while being less trained for offensive cyber work.

That distinction matters. A refusal filter or a usage policy can be switched off by someone running the model on their own hardware. Training data, by contrast, shapes what the model learned in the first place. Moonshot’s own account, as reported by Notebookcheck, is that it noticed the model’s ability to find and exploit vulnerabilities improving steadily as post-training scaled, and traced that improvement to cyber-related content in the general corpus and to cyber tasks in its reinforcement learning environments. Removing that material was therefore an attempt to lower the capability itself, not merely to hide it behind a prompt-level rule.

The company also drew a clear line around its goal. Moonshot said, “we aim not to release open weights that would extend the absolute frontier of cyber capability,” while intending to raise the level available in open models step by step. In plain terms, Moonshot is not claiming it has made an open model harmless. It is claiming it has avoided pushing the public frontier of offensive capability further than it already stands, while still shipping a powerful coding model to developers.

What was kept is just as important as what was removed. Moonshot said the model’s general coding skills stayed strong, and the launch details support that framing. Kimi K3.1 Pro is described as a mixture-of-experts model with around 3 trillion parameters in total — Notebookcheck gives the more precise figure of 2.8 trillion total parameters, with 104 billion active per request — and a context window of 1 million tokens, meaning it can process very large amounts of material in a single session. Moonshot also released K3.1 Pro Highspeed, which it says runs two to three times faster than the standard version. The model is already available through Kimi.ai, the Kimi apps, Kimi Work, the Kimi Code coding tool, and the Kimi API, including a free plan with limited usage, according to Notebookcheck.

For readers, the practical takeaway is narrow but significant. Moonshot did not release a neutered coding model. It released a highly capable coding model whose offensive cyber training was deliberately thinned before the weights go public. Whether that thinning is enough is a separate question, and it is one that only independent testing after November 4 can begin to answer.

Why does an open-weight release make this decision irreversible?

An open-weight release is different from launching a hosted service, because the developer gives up the ability to take the model back. When a model runs only on a provider’s servers, the provider can update its safeguards, restrict an account, or change what the system will do. Once weights are downloaded, copied, and shared, none of those levers work the same way. Anyone with the files can run the model, modify it, and pass it on, and the original developer cannot enforce its rules on copies it no longer controls.

That is the core of the open-weights dilemma, and it explains the timing of Moonshot’s announcement. The company plans to release the full model weights by November 4, 2026. Before that date, it still has a window to shape what goes into the public artifact. After that date, it does not. Notebookcheck reports that no K3.1 version was listed on Hugging Face as of the Sunday after the announcement, and that a Hugging Face page from a company called Audn AI already announces plans to remove K3.1 Pro’s safeguards after release, as it did with GLM-5.3. That detail does not prove anything about what will happen next, but it illustrates the dynamic: safeguards built into a released model are treated by some downstream users as a starting point to be stripped, not as a permanent constraint.

Moonshot itself frames open weights as a double-edged tool for security. On one side, open models let organizations inspect and secure their own software, including older or neglected systems that may receive limited maintenance. A team defending its own code can use a capable model to find weaknesses before criminals do. On the other side, the same capability in the wrong hands can automate parts of an attack: finding flaws, writing exploit code, and chaining together multi-step tasks with software tools.

This tension is not new, but it sharpens with every generation of more capable models. The same pattern — a powerful tool, a safety trade-off, and a debate over who bears the risk — runs through other recent stories in this space, including how agent safety monitoring can be switched off and why dormant agents worry security teams. In each case, the question is not only what a system can do in a demo, but what happens when control passes from the developer to the user.

The policy backdrop reinforces the point. Coverage of the announcement notes that China has proposed export controls targeting AI-driven malware-generation technology and certain AI-assisted vulnerability-discovery tools, with the proposals still subject to public comment. The draft measures reportedly cite risks to critical infrastructure, defence firms, and government systems. Moonshot’s move therefore sits inside a wider argument about whether powerful cyber-relevant capabilities should circulate freely at all, and who gets to decide.

What does Moonshot’s internal benchmark actually prove?

Moonshot’s internal benchmark proves that its own test registered a drop, and not much more than that — yet. On its in-house test, xdev-bench-hard, an agent must exploit recently disclosed vulnerabilities in software such as the Linux kernel and Node.js. A checkpoint trained without the risk-reduction measures solved 90.5% of the tasks, while the final K3.1 Pro solved 81%. That is a 9.5-percentage-point gap, and Moonshot presents it as evidence that filtering cyber data reduced offensive performance.

Three caveats keep that claim in proportion. First, the numbers are company-reported and have not been independently verified, a point every outlet covering the announcement stresses. Second, the benchmark is Moonshot’s own test, designed by the same company that built the model and chose the intervention. An in-house benchmark can be a useful signal, but it is not a substitute for outside evaluation on tests the developer did not design. Third, 81% is still a high score. The final model remains capable of finding and exploiting vulnerabilities in a controlled setting; it is less capable on this test than the unfiltered version, not incapable.

There is also a comparison that cuts both ways. Notebookcheck reports, citing The Next Web, that the original K3 scored 33.3% on the same test. If that figure holds, K3.1 Pro at 81% still represents a large jump over its predecessor, even after the risk-reduction steps. Moonshot also says K3.1 Pro still trails closed frontier models that have been publicly available for at least three months. Put together, those two points describe a model that is much stronger than its own predecessor but, by Moonshot’s account, not at the very frontier of cyber capability among closed systems.

That framing is exactly what Moonshot’s stated goal predicts: raise the open-model level step by step, without extending the absolute frontier. Whether independent researchers agree after November 4 will depend on tests Moonshot did not write, on hardware and setups Moonshot did not control, and on how the model behaves when users try to push it beyond its intended use. Until then, the honest summary is that Moonshot’s intervention moved its own benchmark in the intended direction, by a reported 9.5 points, while leaving a model that still scores 81% on that same benchmark.

Readers should also keep the coding scores in perspective. Notebookcheck reports that Moonshot claims 65.7% on Terminal-Bench 4.0, a test of coding agents on terminal tasks, compared with 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra, while noting these are the company’s own figures. On the independent Artificial Analysis Intelligence Index, K3.1 Pro scores 55, compared with 58 for Opus 5.5. The coding story, in other words, is strong but not runaway, and it rests on a mix of company and independent figures that deserve the same careful reading as the cyber numbers.

Why do defenders and attackers read the same announcement differently?

Defenders and attackers read the same announcement differently because they are asking different questions about the same facts. A defender asks: does this release make it easier for my organization to find and fix weaknesses before they are exploited? An attacker asks: does this release make it cheaper and easier to find and exploit weaknesses at scale? Moonshot’s announcement gives each side something to point to.

For defenders, the encouraging parts are real. An open-weight model that organizations can run and inspect on their own systems is a tool for securing neglected software, testing defenses, and training security teams without depending entirely on a hosted service. Keeping general coding ability strong means the model remains useful for legitimate security work: reviewing code, writing tests, automating patch validation, and exploring large codebases within a 1-million-token context. The reported 9.5-point drop on the internal cyber benchmark also suggests that a developer can, at least in principle, trade a measurable amount of offensive capability for a public release without giving up the model altogether.

For attackers, the encouraging parts are equally real. An 81% score on an exploit benchmark is not a low bar. A model that writes code, operates software tools, and completes multi-step tasks can lower the skill needed to attempt sophisticated attacks, even if it does not hand a novice a finished weapon. And once the weights are public, downstream users can strip safeguards, fine-tune the model, or combine it with other tools in ways Moonshot cannot control. Notebookcheck makes an important technical distinction here: removing safeguards cannot add back capabilities the model never learned in training. That limits what safeguard-stripping alone can achieve, but it does not settle the separate question of whether further training on cyber data could rebuild some of what Moonshot filtered out. That remains an open question raised by the coverage, not an established fact, and it is one of the first things independent researchers will probe after November 4.

The policy debate sharpens the split. Governments and technology companies worry that increasingly capable models could make sophisticated cyberattacks cheaper and easier to execute, putting pressure on organizations that protect personal information, financial systems, and critical infrastructure. At the same time, restricting security research too aggressively could leave vulnerabilities undiscovered, because the same techniques that find flaws for attackers also find them for defenders. Moonshot’s announcement does not resolve that trade-off; it picks a position inside it, and invites the rest of the industry to judge whether that position is cautious enough.

This is also why the announcement resonates beyond one company. The broader argument over powerful models, national controls, and who should have access to what capability is already shaping policy in multiple countries, as seen in the US federal removal order involving DeepSeek. Moonshot’s case adds a new wrinkle: a developer voluntarily limiting its own model before an open release, in public, with numbers attached. That transparency is unusual, and it gives both critics and supporters something concrete to test.

What happens after November 4, and what should readers watch for?

After November 4, the story moves from Moonshot’s claims to everyone else’s evidence. The first thing to watch is whether independent researchers can reproduce anything close to the 81% versus 90.5% gap, and on which tests. If outside benchmarks confirm a meaningful reduction, Moonshot’s approach gains credibility as a template other open-weight developers could follow. If outside tests find the gap much smaller, or find that the model can be pushed back toward the unfiltered version’s performance with modest additional training, the announcement will look more like a gesture than a guardrail.

The second thing to watch is what downstream releases actually do. The Audn AI plan to remove safeguards, reported by Notebookcheck, is an early signal that safeguard-stripping will be attempted quickly. More informative will be whether anyone demonstrates a restoration of filtered capability through further training, and how much data, compute, and expertise that takes. A restoration that requires large-scale effort tells a different story from one that takes a small dataset and a short fine-tuning run. Readers should treat early claims on either side with caution until methods and results are public enough to check.

The third thing to watch is the policy response. China’s proposed export controls on AI-driven malware-generation and vulnerability-discovery tools remain subject to public comment, and other governments are watching how open-weight releases handle cyber capability. If Moonshot’s voluntary limits are seen as working, they may inform voluntary norms or formal rules. If they are seen as failing, pressure for harder controls on open releases could grow. Either way, the November 4 release is likely to become a reference point in that debate, not just a product launch.

For everyday readers, the practical implications are modest but worth stating plainly. Kimi K3.1 Pro’s release does not mean personal devices are suddenly at greater risk overnight, and it does not mean defenders have a new silver bullet either. The model is large — far too large to run on a regular PC or laptop, as Notebookcheck notes — so most people encountering it will do so through Moonshot’s servers, apps, or API, not by downloading weights themselves. The real audience for the weights is developers and researchers, and the real contest is over what they can demonstrate with them in the weeks after release.

Moonshot’s announcement is best understood as a deliberate experiment conducted in public: can a developer ship a near-frontier open coding model while holding back part of its offensive cyber training, and can the rest of the world verify that the holdback worked? The company has stated its goal, described its method, and published numbers that point in the intended direction. The verification phase has not started yet. When it does, after November 4, the results will say more about the future of open-weight releases than the announcement itself.

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment