Moonshot has made Kimi K3.1 Pro available through its products and API, presenting it as a major step up from its Kimi K3 model and promising to release full model weights by November 4. The Chinese AI company says it deliberately removed cyber-related training material and filtered parts of its reinforcement-learning environment before that planned release. Its own tests show the resulting model solving fewer exploit-development tasks than an otherwise comparable checkpoint without those controls. The announcement is notable both as a model launch and as a rare public account of a company changing training inputs to manage risk before releasing weights. But the central safety and capability figures are company-generated, not independently reproduced.

Launch, availability and what remains forthcoming

Moonshot announced Kimi K3.1 Pro on October 23, 2026. In its launch post, it calls the model the first in a new K3.1 series and describes it as a 3-trillion-class open-weight model. The same announcement says a 1-million-token context window is supported. K3.1 Pro and a faster edition named Kimi K3.1 Pro Highspeed were available on the Kimi.ai service, Kimi Work, Kimi Code and the Kimi API at launch. Moonshot says Highspeed delivers two to three times the speed of the regular model; that is a company performance claim rather than an independent measurement.

The distinction between currently available and open-weight matters. At launch, users could access the models through Moonshot’s services and API, but the full weights had not yet been published. Moonshot promised release by November 4. That date is a future commitment, not a completed release, and the launch post does not make the weights available immediately. Independent technology writer Simon Willison also noted on October 23 that K3.1 Pro was on the API but was not yet open weights, and repeated the announced November 4 target in his launch-day account.

Moonshot characterizes K3.1 Pro as a post-trained version of Kimi K3, with substantially more post-training compute. Its account describes expanded reinforcement learning across hundreds of downstream domains and engineering changes to training and inference infrastructure. These are descriptions of the company’s process; the announcement does not provide enough independently auditable information for an outside reader to reproduce the training program or attribute a particular gain to one component.

Benchmark claims and their limits

Moonshot’s reported coding result

On Terminal-Bench 4.0, Moonshot reports a score of 65.7% for K3.1 Pro, compared with 66.4% for Anthropic’s Claude Opus 5.5 and 58.2% for OpenAI’s GPT-6 Astra. The company describes Terminal-Bench 4.0 as a test of coding agents handling realistic, resource-constrained terminal tasks, with task-specific tests used to determine success. On those reported figures, K3.1 Pro falls 0.7 percentage points below Opus 5.5 and exceeds GPT-6 Astra by 7.5 points. Those are percentage-point differences, not percentage improvements.

There is also an important comparison issue. Artificial Analysis, which independently evaluated the model for its own Intelligence Index coverage, reports a 67% Terminal-Bench 4.0 score for K3.1 Pro, rather than Moonshot’s 65.7%. Its October 23 analysis reports 64% for Claude Sonnet 5.5 and says K3.1 Pro had the highest score of any model on that evaluation. This does not establish that one score is wrong: benchmark configurations, run conditions, aggregation or reporting precision may differ. The two score sets should not be silently combined as if they came from one controlled head-to-head test.

Artificial Analysis gives K3.1 Pro a score of 55 on its Intelligence Index and says it ranks fourth overall in its evaluated field, behind Claude Opus 5.5, Claude Sonnet 5.5 and Muse Wonder Full. It also reports 1,846 Elo on GDPval-AA, 312 Elo above Kimi K3, and 73% on AutomationBench-AA, compared with 58% for K3. These are results from Artificial Analysis’s own evaluations and methodology, not confirmation of every benchmark in Moonshot’s launch material. Artificial Analysis says K3.1 Pro would become the highest-scoring open-weights model on its index if the weights are released. That is a conditional forecast dependent on the promised release and on the index’s coverage and definitions.

Factuality figures are stress-test results

Moonshot reports that the model’s claim-level hallucination rate on its internal Kimi Hallu Bench Hard test fell to 8.3%, from 23.4% for Kimi K3. The company specifically cautions that this is a stress test constructed to probe error-prone cases, not an estimate of the model’s error rate in ordinary use. It also reports a relative comparison in the share of answers containing at least one factual error: K3.1 Pro’s rate was 42.4% of K3’s. Neither measure should be presented as a general guarantee of factual accuracy. Neither figure has been independently reproduced in the sources reviewed.

What Moonshot says it changed

Moonshot’s cyber section describes a risk-management choice made during development, rather than a new security feature that end users can toggle. The company says it traced increasing vulnerability-research performance to cyber-related material embedded in its general mid-training corpus and to cyber tasks included in reinforcement-learning environments. It says preliminary internal experiments found that leaving cyber material in either stage could substantially increase downstream cyber capability. For K3.1 Pro, Moonshot says it identified and removed cyber-related data from mid-training and filtered cyber-related tasks from the reinforcement-learning environment mix while keeping general-purpose coding tasks.

To report the effect, Moonshot used xdev-bench-hard, an in-house benchmark of source-code-based vulnerability discovery and exploitation tasks. According to the company, the benchmark includes reproduced, recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL, with mitigations enabled. Tasks provide vulnerable source code, a short bug hint and a corresponding binary. The agent must produce an exploit that achieves arbitrary code execution in a separate sandbox and retrieve a secret string that can be checked automatically.

The score is reported as pass@3 over a random subset of runs. Moonshot says there are no hard timeouts or output-token limits. In that setup, it reports that a checkpoint without the cyber-data removal and reinforcement-learning filtering solved 90.5% of problems, while K3.1 Pro solved 81.0%. It reports Kimi K3 at 33.3%, DeepSeek-V4.1-Flash at 85.7% and a GPT-5.6 Sol result of 100 problems solved, with the latter attributed to a third-party evaluation. The 90.5% and 81.0% figures are pass@3 success rates; the 100 figure is a count of problems solved, not a directly comparable percentage unless the evaluated problem count and protocol align. Moonshot’s published chart and text do not provide independent validation of these comparisons.

What the cyber comparison can and cannot establish

The company’s 9.5-point gap between its unfiltered comparison checkpoint and K3.1 Pro is evidence of what Moonshot says it observed under its internal test conditions. It is not by itself a measure of how much real-world cyber risk has been removed. The task set, sampling, run variation, scoring protocol and relationship between the benchmark and practical security work all affect interpretation. Moonshot describes the benchmark’s construction, but an external evaluator has not published a replication of the results in the sources reviewed.

The company also stresses that removing cyber-specific material did not erase capabilities acquired through general coding. K3.1 Pro’s reported 81.0% remains above the reported 33.3% for Kimi K3. Moonshot says this reflects, in part, the way general coding and long-horizon debugging ability can transfer to cyber tasks. That explanation is plausible as a company interpretation, but the score comparison alone cannot isolate why the model succeeds or establish which capabilities are transferable across settings.

Moonshot says the model’s offensive cyber capability remains below frontier proprietary systems publicly available for at least three months. Its own table includes a GPT-5.6 Sol third-party evaluation, but does not by itself settle how representative that comparison is across model versions and protocols. The company’s broader claim that its approach reduces misuse risk therefore remains a claim to test, not a guarantee that open weights will be safe or that the model cannot assist harmful activity.

The open-weight trade-off

Moonshot frames its approach as a two-part policy. It says it does not want to release open weights that extend the absolute frontier of cyber capability, while also intending to increase the cyber capability available through open models over time. The company argues that open access can help defenders audit code, including legacy software that receives little maintenance. That is Moonshot’s rationale for distributing dual-use capability; the launch announcement does not quantify the benefits or show that they outweigh possible misuse.

Open weights change the practical governance picture because a released model can be run and modified outside its original provider’s hosted service. Once weights are available, the developer has less direct ability to monitor each use or change the model centrally. This makes the timing significant: the product launch is live, but the more consequential open-weight step is still scheduled for November 4. Whether Moonshot keeps that date, what license and safeguards accompany the release, and whether independent researchers can evaluate the claims after publication are questions that remain open as of October 24.

The announcement is therefore more than a performance comparison. It publicly describes an attempt to steer a model’s capabilities before a planned open release, and supplies a numerical before-and-after comparison on a specialized internal test. That transparency is useful, but it does not substitute for external replication. The clearest established facts are the October 23 product and API launch, the currently unavailable weights, and Moonshot’s stated November 4 target. The benchmark outcomes and the degree of risk reduction should remain explicitly attributed to Moonshot until outside evaluations test them.

Frequently asked questions

Is Kimi K3.1 Pro already an open-weight model?

No. Moonshot made K3.1 Pro available through its own products and API on October 23, but the company said full weights would be released by November 4. The open-weight release was still pending on October 24.

What does Moonshot mean by removing cyber-related training data?

The company says it identified cyber-related material in mid-training data and cyber tasks in reinforcement-learning environments, then removed or filtered those inputs for K3.1 Pro. It says it retained general-purpose coding tasks. The description is Moonshot’s account of its development process.

Did the cyber controls make K3.1 Pro unable to exploit vulnerabilities?

No such conclusion follows from the announcement. Moonshot reports an 81.0% pass@3 score on its internal xdev-bench-hard test after controls, compared with 90.5% for a checkpoint without them. That shows substantial reported performance remained on this benchmark. It does not establish performance across all real-world vulnerabilities or misuse scenarios.

Are the coding and factuality benchmarks independently verified?

Not all of them. Artificial Analysis independently reports results for its Intelligence Index and evaluations including Terminal-Bench 4.0, but the separate Moonshot benchmark claims—including xdev-bench-hard and Kimi Hallu Bench Hard—are company-generated and have not been independently reproduced in the sources cited here.

When are the model weights expected?

Moonshot says the full weights will be released by November 4, 2026. This is a stated future target, not evidence that the weights are already published.

References