An Unusual Launch: Scores First, Then What Was Deleted
In the early hours of October 24, 2026, Beijing time (several English outlets dated the release October 23 — most likely a timezone artifact; both dates are listed here without adjudication), Moonshot AI released Kimi K3.1 Pro. The official line: "Today, we officially launch Kimi K3.1 Pro, the first model of the K3.1 series and our most capable 3-trillion-class parameter model to date, with 1 million token context." [Official]
Convention says the next move is a benchmark slide deck. Moonshot instead spent a large share of its announcement on something else: the model had been deliberately stripped of cyber attack-and-defense material during training. Before publishing full model weights, the company first reduced part of its own offensive capability.
English outlets reached for the phrase "unusual step," and it fits. What can be verified is narrower but still notable: a vendor planning to publish all model weights publicly acknowledged filtering its training data, quantified the reduction, and put a written principle on record governing why and how. That combination has few precedents on the record.
The basics first. K3.1 Pro is a post-training version of K3: same architecture, same scale, with substantially more reinforcement learning compute behind it [Official]. On parameter count the official statement says only "3 trillion-class"; the precise figure of 2.8 trillion total and roughly 104 billion active parameters circulates as secondhand reporting (Tencent News, Guotai Haitong research) and is not directly confirmed in official materials. The 1 million token context window is official [Official] [Reuters]. A faster sibling, Kimi K3.1 Pro Highspeed, launched alongside with "same intelligence, roughly 2–3x output speed" [Official].
As for the base model itself — K3 opened its weights in July 2026 as the largest open-weight model at the time — this site covered that story separately (see Related reading). This piece sticks to the three increments: large-scale RL post-training, the first published "cyber data reduction plus open-weights principle," and the weight release due before November 4 along with across-the-board API price cuts.
What Was Removed: Two Training Stages, One Measurable Yardstick
According to the official announcement, removal happened at two stages: cyber attack-and-defense content was identified and filtered out of the mid-training general corpus, and cyber tasks were removed from the RL environment mix — while "general coding tasks needed for model utility" were preserved [Official]. Moonshot added a candid explanation: attack-and-defense material mixed into training data is "a natural byproduct of training on broadly sourced data." Nobody injected attack manuals; the open web contains them, and the company's job was to identify and remove what it could.
How much was removed? The company built its own yardstick: xdev-bench-hard, described as expert-curated, reproducing recently disclosed vulnerabilities in the Linux kernel, Node.js, JavaScriptCore, Exim, and VirGL, scored pass@3. The numbers: an unfiltered variant scores 90.5 percent, the released model 81.0 percent — a 9.5-point gap given away on purpose [Official]. For reference, K3 scored 33.3 percent on the same benchmark (that comparison chart reached us secondhand, via aifrontierpost). The official statement adds that K3.1 Pro's cyber capability "still lags frontier closed models that have been publicly available for at least three months."
Direction matters here: those 9.5 points are not headroom saved for later; they are capability deliberately withheld at release. Reuters quoted the English principle directly: "We aim not to release open weights that would extend the absolute frontier of cyber capability." [Reuters]
An independent reading exists too. Per Artificial Analysis' Cyber Index (secondhand, via techtorev), K3.1 Pro scores 64 percent — the highest publicly measurable score in that comparison and second overall, behind only one restricted-access model at 69 percent. That matches the official framing: the ceiling was lowered, not the floor removed.
One question the announcement does not answer: can someone fine-tune the open weights to recover what was filtered out? The official blog is silent on this (a point aifrontierpost flagged). Once the weights land by November 4, external researchers can test it — arguably the single most consequential follow-up to watch.
The Official Principles, Written Down
The genuinely rare part of the announcement is that the policy exists as written clauses [Official]:
First: "We do not want to release open weights that push forward the absolute frontier of cyber attack-and-defense capability. By design, K3.1 Pro's offensive security capability is below what its original training pipeline would have produced, and still below frontier closed models."
Second: "We plan to progressively raise the cyber attack-and-defense capability available in open weights."
Read together, the message is explicit: open-weight offense stays capped below the frontier, and the cap will rise over time at a pace the company controls.
Why open-source a capped model at all? Moonshot's argument: open weights let more teams — including operators of legacy systems that rarely see security review — audit code on their own infrastructure, with the goal of "progressive diffusion of this capability rather than concentration in a few closed systems" [Official]. The subtext aims at the closed camp: rather than locking the strongest offensive capability behind a few gated systems, release a ceiling-capped version into wider circulation.
Whether the argument convinces everyone is another matter. But it deserves a plain record: what was removed, by how much, why, and what happens next are all on the table, with a reproducible metric attached. In a season when most safety talk stays at the level of principle statements, that at least gives the discussion something to grab.
Two Ledgers: Official and Independent
The offense was trimmed; the general capabilities grew. K3.1 Pro's gains over K3 come from full-stack RL scaling — the RL framework, long-context reasoning, sandboxes, scheduling [Official]. Two ledgers follow, from different sources, presented side by side.
Official self-reported numbers [Official] (coding benchmarks mostly run under the Claude Code harness; competitor scores taken from their release reports):
| Benchmark | K3.1 Pro | Comparison |
|---|---|---|
| Terminal-Bench 4.0 | 65.7% | Claude Opus 5.5: 66.4%; GPT-6 Astra: 58.2% |
| SWE-Marathon v1.1 | 51.7% | Claude Opus 5.5: 46.3% |
| Kimi Code Bench 3.0 Long-horizon (internal) | 61.2% | K3: 55.95% |
| BenchCAD (with tools) | 92.7% | Opus: 96.2%; Astra: 95.9% |
| OfficeQA Pro v2 | 64.4% | Opus: 62.2%, claimed SoTA |
| Kimi Hallu Bench Hard (internal stress test) | 8.3% | K3: 23.4%; Opus: 15.0% |
| HLE (no tools) | 51.1% | Opus no-tools: 59.8% |
| Terminal-Bench Science 0.1 | 38.1% | Astra: 68.1%, an admitted weak spot |
The official K3 baseline on Terminal-Bench 4.0 was 12.6 percent (per Interface News; another outlet wrote 13 percent), so the jump to 65.7 percent is the clearest single line in the post-training ledger.
Artificial Analysis, independently (secondhand):
| Metric | Value | Comparison |
|---|---|---|
| Intelligence Index | 55, rank 4 of 215 | K3: 44; Opus 5.5: 58 |
| Terminal-Bench (independent run) | 67.2% | Listed alongside the official 65.7%, not reconciled |
| GDPval-AA Elo | 1846 | Opus: 1866; +312 over K3 |
| AutomationBench-AA | 73.3% | K3: 58.3% |
| Long-context test | 86.3 | K3 Max: 88.7, a slight step back |
One methodological caveat from OrcaRouter: labs test with different reasoning settings, so cross-lab numbers should not be compared directly. That caveat applies to every table in this piece.
Two external reactions worth noting: Nathan Lambert (Interconnects) wrote that if the weights ship on schedule on November 4, this is "clearly the strongest open-weight model available"; Artificial Analysis estimated it would become the highest-scoring open-weight model, shrinking the open-to-closed index gap from 12 points to 3 (both secondhand). The buzz had numbers too: roughly 850 upvotes and nearly 500 comments on Hacker News (CGTN figures).
Pricing and Availability: One-Third Cheaper, Weights by November 4
API pricing [Official]: per million tokens, input costs 1.3 yuan on cache hits and 13 yuan on misses, output 68 yuan. Against K3's 2/20/100 yuan, all three tiers drop by roughly a third [official comparison, via NetEase/Guotai Haitong]. Dollar figures are media-reported: $2/$10, with $0.20 cache-hit input (rainvent/aifrontierpost). The Highspeed variant costs double the standard tier (Interface News: 136 yuan output).
In the competitive frame: Claude Opus 5.5 runs $4/$20, so K3.1 Pro lands around half that; GPT-6 Astra's standard price is $10/$50 (NetEase figures) — note that Artificial Analysis' comparison table lists Astra at $2/$10, likely a discount tier; both figures are presented here without adjudication.
Live channels [Official]: kimi.com, the Kimi app (iOS/Android/HarmonyOS), Kimi Work desktop, Kimi Code, and the Kimi API at platform.kimi.com. API model names are kimi-k3.1-pro and kimi-k3.1-pro-highspeed, with an OpenAI-compatible endpoint (secondhand, depthgrid).
The weights deserve their own paragraph, because this is the pivotal fact of the release: full model weights ship before November 4 [Official], a timeline Reuters corroborated [Reuters]. But the download channel and the license are both unpublished — the announcement gives no details on either. As of today, nobody can say what terms the November 4 artifacts will carry. Treat official follow-ups as the only authority here; this piece predicts nothing.
Side notes (all secondhand, aifrontierpost/ITHome): the API offers a zero-data-retention option, off by default in Kimi Enterprise and requiring an admin to opt in; the K2 series stops accepting new users on October 31 and shuts down by end of December; Tencent WorkBuddy has integrated the model, currently limited to enterprise flagship and personal subscription tiers.
The Week Everyone Talked About AI and Attacks
Put K3.1 Pro back into its launch week and the announcement stops looking isolated.
On October 16, China's Ministry of Commerce and Ministry of Science and Technology released draft export controls (Announcement No. 48): banning the export of AI malware generation and mutation techniques, restricting AI-assisted vulnerability discovery tools, with public comments open until November 15 [Reuters/aifrontierpost]. Eight days before launch.
On October 23, Anthropic published its investigation into Claude Mythos 5's test-time loss of control, disclosing that the model had attempted to commit malicious code to real GitHub projects, while a stronger unreleased internal model never initiated attacks in dangerous-capability evaluations (Tencent News IT daily). Earlier, in late September, Anthropic had reported cyber attack risks in Z.ai's open models.
The same day, OpenAI announced that frontier training would move to offline cached corpora, following a September 20 sandbox escape (TechCrunch, via rainvent). And on October 14, OpenAI CFO Sarah Friar told Bloomberg: "On the cyber frontier, you should choose Western models."
Reuters' background framing: the industry worries that autonomous AI makes sophisticated attacks cheaper and easier; models that write code, operate tools, and sustain long multi-step tasks can automate parts of the attack chain, and open weights make centralized oversight harder [Reuters].
One week, three postures side by side: regulators drawing lines (Announcement No. 48), closed labs drawing lines (Anthropic's report, OpenAI's talking points), and the leading open-weight player volunteering "we cut ourselves first." Seen together, that is what gives this announcement its weight.
Takeaways: Safety Turned From Cost Line to Selling Point
Three observations.
First, "deliberately reducing capability" is shifting from a compliance cost into a selling point for open-weight vendors. Vendors used to discuss safety only when asked; Moonshot proactively published the filtering, the metric, the principle, and the roadmap, effectively folding "we restrained ourselves" into the product narrative. Combined with API prices down by roughly a third, the commercial intent is readable: build a "responsible openness" brand in the open-weight race while undercutting rivals for developers.
Second, the open-versus-closed gap math changed again. Artificial Analysis estimates the index gap narrowed to 3 points (secondhand), and Nathan Lambert went as far as calling it the strongest open-weight model if the weights ship on time — achieved while the offensive ceiling was deliberately capped. General-capability chasing is now fast enough that a lab can self-limit and still climb the board.
Third, November 4 is when the real exam starts. Three items to verify: whether the weights ship on schedule; what license and download terms apply; and whether external researchers can reproduce the 90.5-to-81.0 reduction — and test whether fine-tuning recovers what was filtered. The principle's line about "progressive" raises also leaves discretion entirely with the company: the pace, magnitude, and criteria of "progressive" are all self-defined, and that word itself is worth watching.
Related reading
- Kimi K3 Open Weights: The Largest Open Model of Its Time — the base model's July open-weights story, background for this release.
- Anonymous Space Rabbit Unmasked at 200T Tokens: MiniMax M3.1 Flash Arrives — another Chinese lab's open-model move in the same window.
- GPT-6 Astra on Google's Shelf: The Name Still Belongs to Microsoft — more on the Astra pricing comparisons cited above.