Moonshot Cut Kimi K3.1 Pro's Exploit Rate to 81%

Moonshot AI has shipped the first open-weight frontier model whose developer published how much hacking ability it deliberately trained out: Kimi K3.1 Pro solves 81% of the company’s exploit-development tasks, down from 90.5% for the same model trained without cyber data removal. The technical blog Moonshot released on October 23 also shows why that cut has limited reach, because an open model already in circulation scores higher than the version Moonshot held back from.

Kimi K3.1 Pro lands within a point of Claude Opus 5.5 on Terminal-Bench 4.0

K3.1 Pro is a post-trained version of Kimi K3, the roughly 3 trillion-parameter model Moonshot released in July, with what the company describes as substantially larger reinforcement-learning compute spread across hundreds of task domains. It keeps a 1 million-token context window and adds a Highspeed variant that Moonshot says runs two to three times faster. Both went live on October 23 across Kimi’s apps, its coding tool and its API, with downloadable weights promised by November 4.

On Terminal-Bench 4.0, which grades coding agents on constrained terminal tasks, Moonshot reports 65.7% for K3.1 Pro, 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. On BenchCAD, a 3D reconstruction test, it scores 92.7% with tools against 96.2% for Opus 5.5. Moonshot also reports its claim-level hallucination rate on an internal stress test falling from 23.4% for K3 to 8.3%. All of these figures are self-reported and have yet to be reproduced independently.

Moonshot removed cyber data from two training stages and lost 9.5 points of exploit skill

The cybersecurity section of the blog is the part with lasting value for the industry. While scaling post-training, Moonshot’s researchers watched vulnerability-research performance climb steadily and traced the rise to two sources: cyber content buried in the general mid-training corpus, and cyber tasks mixed into the reinforcement-learning environments. Internal experiments showed that leaving either stage untouched raised downstream cyber capability substantially, so for the open release the team stripped cyber-related data from both while keeping general coding tasks.

Moonshot measured the result on xdev-bench-hard, an in-house set of exploitation tasks that reproduce recently disclosed flaws in the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL with mitigations switched on. The model has to write a working exploit, achieve code execution in a separate sandbox and retrieve a secret string.

“First, we aim not to release open weights that would extend the absolute frontier of cyber capability. K3.1 Pro’s offensive cyber capability is, by design, below what our pipeline can produce, and remains behind that of frontier proprietary models.”

Moonshot AI, Kimi K3.1 Pro Tech Blog, October 23, 2026

DeepSeek’s open model already scores above the version Moonshot held back

Moonshot’s own chart contains the complication. DeepSeek V4.1-Flash, whose weights are already public, solves 85.7% of the same tasks, which places it above the released K3.1 Pro and within five points of the unfiltered Kimi checkpoint Moonshot chose to withhold. Zhipu’s GLM-5.3 sits at 57.1%, the same open model Anthropic documented assembling a working exploit chain earlier this month. Moonshot’s rule keeps its own release under the closed frontier, where GPT-5.6 Sol solves every task, while the practical ceiling for open weights is whatever the most permissive lab publishes. A cautious release lowers Moonshot’s marginal contribution to that ceiling and leaves the ceiling itself in the hands of others.

General coding skill rebuilds much of what data removal takes away

The second figure worth holding onto is the jump from K3 to K3.1 Pro: 33.3% to 81.0% on the same exploit test, achieved after the cyber data was removed. Moonshot attributes the gain to stronger general coding and long-horizon debugging, which generalize to exploitation whether or not the training mix includes it. That makes data filtering a measurable but shrinking brake, since every improvement in ordinary software engineering lifts the floor beneath it. Moonshot says as much, stating that it intends to “progressively raise” the cyber capability available in open weights and arguing that wide access helps defenders audit code that rarely receives a security review.

For security teams the timeline is concrete. Once the weights ship on November 4 they can be fine-tuned with the very data Moonshot removed, and a downloaded checkpoint cannot be recalled. The release does give the rest of the industry a reusable method: trace where a dangerous capability enters training, remove it at each stage, and publish the before and after on a named benchmark. Other labs preparing open releases, including Mistral with Large 4, now face a public reference point for what that disclosure looks like.

Moonshot has shown that a lab can measure and lower the hacking skill of its own open model at a cost of 9.5 points, and the same chart shows that a single lab’s restraint moves the open-weight ceiling very little while general coding gains keep pushing it up.