Moonshot launches Kimi K3.1 Pro with hacking skills deliberately curbed

Moonshot AI released Kimi K3.1 Pro on October 23, 2026. It is a 2.8-trillion-parameter model with a one-million-token context window, and Moonshot charges a third less per token for it than for Kimi K3. The most unusual detail is about safety: before promising open weights by November 4, Moonshot says it deliberately trained down the model’s ability to find and exploit software vulnerabilities. In its own test, the exploit score fell from 90.5% to 81.0%.

Reports differ slightly on the launch date. Several outlets and Moonshot’s own launch post give October 23. Digital Trends gives October 24, and Caixin reports a release “early Saturday”. The gap most likely reflects time zones.

What Kimi K3.1 Pro changes over Kimi K3

Despite the new name, K3.1 Pro does not have a new architecture. Moonshot describes it as Kimi K3, released in July, further trained with significantly more compute in the post-training phase. That phase included large-scale reinforcement learning (training by trial and reward) across hundreds of task domains. It is the first model in Moonshot’s K3.1 series.

The model is a mixture-of-experts (MoE) design. Instead of running every parameter for every token, it routes each token to a small group of specialist sub-networks. It activates 16 of its 896 experts per token, about 104 billion of its 2.8 trillion parameters. Moonshot says it uses Kimi Delta Attention, its own memory-saving attention method, together with “Attention Residuals” to reduce compute overhead. The Elec describes Kimi Delta Attention as Moonshot’s implementation of Gated DeltaNet, which cuts the memory needed to process long contexts. It was already used in K3. Moonshot’s launch post also calls the model multimodal.

Spec	Kimi K3.1 Pro
Total parameters	2.8 trillion (MoE, 16 of 896 experts active)
Active parameters per token	104 billion
Context window	1,048,576 tokens
Base model	Kimi K3 (July 2026)
API price, input / output per 1M tokens	$2 / $10 (Kimi K3: $3 / $15)
Highspeed variant price	$4 / $20
Open weights	Announced for November 4, 2026

Specifications and prices as reported by Basic Tutorials from Moonshot’s launch materials.

Moonshot pitches the gains at practical, multi-step work: long-running coding projects, 3D creation, financial research and agent workflows. Its launch post claims full-project coding of games in Unreal, Unity and Godot, and parametric 3D modeling in Blender and CAD tools. It also claims hallucination on finance work is down 65%. On its internal Kimi Hallu Bench Hard test, the share of hallucinated statements fell from 23.4% in K3 to 8.3%. Moonshot cautions that the test deliberately uses error-provoking tasks, so these figures do not reflect everyday error rates.

Benchmarks: Moonshot’s numbers and Artificial Analysis

Independent: Artificial Analysis

Independent evaluator Artificial Analysis ranks K3.1 Pro fourth on its Intelligence Index, a composite of several tests. It scores 55, up 11 points from its predecessor. The evaluator says that once the weights are published, it would become the highest-ranked open-weight model on the index. In that ranking it sits ahead of GPT-6 Astra at 53, as well as Claude Fable 5.1 and Google’s Gemini 4 Argon. It trails Anthropic’s Claude Opus 5.5 and Sonnet 5.5 and Meta’s Muse Wonder. Notebookcheck, citing Simon Willison, puts Opus 5.5 at 58.

Artificial Analysis also measured Terminal-Bench 4.0, a test of coding agents doing tasks in a command line. On its run, K3.1 Pro scores 67%, up from 13% for Kimi K3 and ahead of Claude Sonnet 5.5 at 64%, the top score among all models it lists. On GDPval-AA, which measures practical work tasks, it reaches 1,846 Elo, 312 points above K3. WinBuzzer reports that its business-software workflow score rose from 58% to 73%. Gains on knowledge and science tests were smaller, which WinBuzzer reads as mainly a gain in sustained task execution.

Self-reported by Moonshot

Moonshot’s own figures, which have not been independently verified, put it close to the leaders:

• Terminal-Bench 4.0: 65.7%, against GPT-6 Astra at 58.2% and Claude Opus 5.5 at 66.4%.
• Kimi Code Bench 3.0 Long-horizon (internal): 61.2%, up from 55.95%.
• BenchCAD (rebuilding 3D objects from multi-angle images, with tools): 92.7%, behind Claude Opus 5.5 at 96.2% and GPT-6 Astra at 95.9%.
• OfficeQA Pro v2 (financial document analysis): 64.4 points.

Moonshot’s launch post says the model is “matching the strongest proprietary models” on key benchmarks. The BenchCAD result shows that claim does not hold everywhere in Moonshot’s own data.

Where Kimi K3.1 Pro is available

According to Moonshot, K3.1 Pro and a faster Highspeed variant are live from launch day in several places:

• Kimi.ai and the Kimi apps for iOS, Android and HarmonyOS
• The Kimi Work desktop app, version 3.1.0 or later, on Windows and Apple Silicon Macs
• Kimi Code, via the /model command
• The Kimi API, under the names kimi-k3.1-pro and kimi-k3.1-pro-highspeed

Kimi Enterprise customers can enable the model for their organisation, but it is disabled by default at launch. Free-plan users get “Limited usage” on the web and in Kimi Work, and Moonshot does not say how much that covers. The Highspeed variant, which Moonshot says is two to three times faster, requires the Pro plan or higher. Notebookcheck notes that Moonshot mentions a zero-data-retention option only for API customers.

Moonshot sets API prices at $2 per million input tokens and $10 per million output tokens, against $3 and $15 for Kimi K3. The Rundown describes this as Sonnet 5.5 pricing and a fifth of GPT-6 Astra’s rate.

How Moonshot trained down the model’s hacking skills

Moonshot says the model’s ability to find and exploit vulnerabilities improved steadily as post-training scaled. It traced this to cyber-related content in the general training corpus and to cyber tasks in its reinforcement-learning environments. For the open-weight release, it removed cyber-related material from mid-training data and filtered cyber tasks out of the reinforcement-learning environments, while keeping general-purpose coding tasks.

The effect was measured on xdev-bench-hard, an in-house test. A task counts as solved when the model finds a source-code flaw, triggers arbitrary code execution inside a separate sandbox and returns a secret string that can be checked automatically. The targets include recently disclosed vulnerabilities in software such as the Linux kernel and Node.js. Under pass@3, which credits a task if any of three attempts succeeds, K3.1 Pro solved 81.0%. A comparable checkpoint without the safeguards solved 90.5%, and Kimi K3 solved 33.3%.

“We aim not to release open weights that would extend the absolute frontier of cyber capability.” (Moonshot AI)

The capability is reduced, not removed. The final model still scores far above its predecessor on this test. Moonshot says it intends to raise the capability available in open models step by step, and that K3.1 Pro still trails closed frontier models that have been public for at least three months. TokenPost notes that Moonshot computed pass@3 over a random subset of runs, without hard timeouts or output-token limits. It adds that the scores do not show how many real-world attacks the safeguards prevent.

On the defensive side, The Rundown reports that Artificial Analysis ranks K3.1 Pro the best openly available cyber-defence model. It scores 64% with no safety refusals and trails only a GPT-6 variant offered to vetted defenders.

Ethereum co-founder Vitalik Buterin backed Moonshot’s approach of limiting risky tasks instead of restricting who can use the model.

“Discriminating against use cases is MUCH less bad than discriminating against users.” (Vitalik Buterin)

Buterin argued that society needs time to harden systems, review older code and formally verify new code. He warned that a poor response to AI risk could lead to locked-down models, identity checks and surveillance.

What it means for builders, and the caveats

For teams building agents that call tools repeatedly, debug and revise, K3.1 Pro is a lower-priced option near the top of independent rankings. Artificial Analysis calculated an average cost of $2.11 per task on its index, against $5.98 for Claude Opus 5.5 at maximum reasoning effort.

Low per-token prices do not guarantee low bills, though. Artificial Analysis measured output at 73 tokens per second, below the average of 81. The model also generated 150 million tokens during the index run, against a median of 87 million. The evaluator’s verdict:

“Kimi K3.1 Pro delivers top-tier performance at a reasonable price compared with other models in a similar price range, but its drawbacks include considerably slower speeds and very lengthy responses.” (Artificial Analysis)

WinBuzzer reaches a similar conclusion from benchmark and small-task tests: longer reasoning and repeated tool calls can offset the cheaper token rate.

Other open questions:

• Safeguards after release. Open weights cannot be withdrawn, and others can strip out built-in safeguards. A Hugging Face page from Audn AI already announces plans to remove K3.1 Pro’s safeguards after release. Removing safeguards cannot restore capabilities the model never learned in training.
• Distillation allegations. The US government, Anthropic and OpenAI have accused Moonshot of unauthorized distillation, meaning training on another model’s outputs. Anthropic alleges Moonshot used fraudulent accounts and proxy networks to collect Claude responses and reasoning traces. Moonshot did not publicly respond to these allegations.
• Promotion dispute. A creator named Elshayib alleges instructions to hide paid sponsorship of the launch. WinBuzzer says the authorship of those instructions, Moonshot’s authorization and any paid placements remain unverified.
• Data handling. Until the weights ship, anyone using the model is running it on Moonshot’s servers.
• Local hosting. A model this size will not run on a regular PC or laptop.

The business and policy backdrop

Bloomberg reported this month that Moonshot completed a private funding round valuing it at about $50 billion. Citing people familiar with the matter, it said the company is targeting a Hong Kong listing in the first quarter of 2027. Incrypted reports that Moonshot’s annual recurring revenue run rate passed $1 billion in August, up from $300 million in June.

On policy, China has proposed export controls covering AI-driven malware-generation technology and some AI-assisted vulnerability-discovery tools. The proposals are still open for public comment. A Bloomberg Intelligence report puts the gap between China’s top models and US rivals at around 3%, the lowest on record.

What to watch next

The key date is November 4, Moonshot’s deadline for publishing the full weights. After that, developers and security researchers can test the cyber claims themselves, and efforts to strip the safeguards will show how far the training-data filtering holds. Basic Tutorials expects more independent results in the coming days now that the model is on the API. Real-world bills, given the model’s high token use, are also worth tracking. The Rundown notes that scores like these have often been followed by major releases from Anthropic and OpenAI.