Moonshot AI Restricts Hacking Capabilities in Kimi K3.1 Pro Ahead of Open-Weight Release

Before an open-weight artificial intelligence model is released to the public, its core capabilities are permanently locked in during the mid-training and reinforcement learning phases. Once those model weights are downloaded by users, the original developer loses the ability to restrict access, monitor usage, or bolt on safety filters. That is why Chinese artificial intelligence startup Moonshot AI intervened at the foundational data level for its latest release.[1][3]

On Friday, the Beijing-based company introduced Kimi K3.1 Pro, a 3-trillion-parameter model that approaches the performance of top-tier proprietary systems. But the most significant architectural change was what Moonshot deliberately left out. The company actively stripped cyberattack-related material from the model's training corpus and reinforcement-learning environments.[1][2]

The goal was to intentionally restrict the model's offensive hacking capabilities before its weights are published for public download on November 4. By removing the sensitive data before the model finished training, Moonshot ensured that the released version fundamentally lacks the specialized knowledge required to push the absolute frontier of software exploitation.[1][2]

"We aim not to release open weights that would extend the absolute frontier of cyber capability," Moonshot said in its announcement regarding the data removal.[1]

Measuring the downgrade

The data removal had a measurable impact on the model's ability to find and exploit software vulnerabilities. According to Moonshot's internal testing, a version of K3.1 Pro trained without the risk-reduction measures solved 90.5 percent of tasks on an in-house exploit benchmark.[3]

The filtered version that Moonshot actually released saw its success rate drop to 81.0 percent on the same test. While that represents a deliberate downgrade, it still marks a massive leap from the predecessor model, Kimi K3, which managed only a 33.3 percent success rate on the same benchmark.[3]

The test, known as xdev-bench-hard, requires the AI agent to exploit recently disclosed vulnerabilities in software like the Linux kernel, Node.js, and Exim. A task is only considered solved if the agent can run arbitrary code in a sandbox environment and successfully retrieve a secret string.[3]

However, the exact nature of the downgrade remains difficult to verify independently. The exploit test is an unpublished, in-house benchmark, meaning outside security researchers cannot yet confirm how the 81.0 percent score translates to real-world threat environments or whether the missing capabilities can be restored.[3]

Coding performance remains intact

Despite the targeted removal of cyber-offensive data, Moonshot claims the model's general coding and reasoning capabilities remain largely intact. The company stated that stronger general coding and long-horizon debugging skills naturally generalize to cyber tasks, which explains why the filtered model still vastly outperformed its predecessor.[1][3]

On Terminal-Bench 4.0, a standard evaluation for artificial intelligence coding agents, K3.1 Pro scored 65.7 percent. That places it ahead of OpenAI's GPT-6 Astra at 58.2 percent and just narrowly behind Anthropic's Claude Opus 5.5, which scored 66.4 percent on the same test.[2][3]

The model also features a massive 1-million-token context window and native image and video understanding. It is designed for long-horizon coding, 3D creation, and complex financial research, operating as an autonomous agent that can execute multi-step workflows without human intervention.[2]

Alongside the base model, Moonshot shipped a faster variant called Kimi K3.1 Pro Highspeed. The company claims this version delivers two to three times the speed of the standard model while maintaining identical capabilities, trading API quota for more responsive interactions during complex tasks.[2]

The open-weight dilemma

Moonshot's decision highlights a growing tension in the artificial intelligence industry regarding open-weight models. Unlike proprietary systems hosted on controlled corporate servers, open weights allow developers to run and modify the software entirely on their own local hardware.[1][3]

This decentralized approach makes central oversight nearly impossible once the files are distributed. Governments and security researchers have expressed mounting anxiety that highly capable open models could automate vulnerability discovery, making sophisticated cyberattacks cheaper and more accessible to malicious actors.[1]

Last week, China proposed export controls that would ban the export of artificial intelligence-driven malware-generation technology. The draft measures specifically cite the risk that AI-assisted vulnerability-discovery tools could be weaponized against critical infrastructure and defense systems.[1]

Moonshot argues that open-weight models can actually improve global cybersecurity if deployed responsibly. By making advanced coding agents widely available, the company suggests that more organizations will be able to inspect and secure their own legacy software systems that typically receive little attention.[1]

Yet, the company acknowledged the need for caution regarding offensive capabilities. Moonshot stated it intends to progressively raise the cyber capability available in open weights over time, rather than releasing maximum-capability models all at once to an unprepared public.[1]

Unverified claims and market positioning

While the benchmark scores are impressive, they are entirely self-reported by the manufacturer. Moonshot has not yet released the weights, meaning independent evaluators have not verified the model's performance or the effectiveness of its safety filters against dedicated adversarial attacks.[2][3]

Furthermore, internal documents from the company present conflicting data regarding the model's reliability. Moonshot's launch blog claims the model's hallucination rate fell to 8.3 percent, but its API documentation cites a different decline to 6.85 percent based on user-flagged errors.[3]

The model is currently available through the Kimi.ai platform and its API, where it undercuts the pricing of its predecessor. Developers and security researchers are now waiting for the November 4 weight release to see if the model's restrained hacking capabilities can be easily reversed through fine-tuning.[2][3]