Open Weights Safety Has a Price Now: Kimi K3.1 Pro's 9.5-Point Trim

Moonshot published the price of a safety cut to Kimi K3.1 Pro. Its own chart shows open weights AI models anyone can download today scoring above the trimmed release.

Moonshot put a number on cutting hacking skill out of an open-weight model before release: 9.5 points on its own test. The chart that carries that number also shows what a cut of that size leaves in place.

Moonshot launched Kimi K3.1 Pro on Oct 23, calling it "our most capable 3T-class open-weight model to date", with a 1-million-token context window. ("3T-class" is Moonshot's size label; our reading is roughly three trillion parameters, the adjustable numbers inside a model.) Open weights means the finished model files get published for anyone to download and run, and Moonshot says full weights land by Nov 4. Before that download day, it removed cyber-related data from two training stages, so the release would be worse at hacking than the same training pipeline would otherwise produce.

Reuters ran the trim as the story on Oct 24, under the headline "Moonshot curbs hacking ability in new Kimi model as fears grow over AI-powered cyberattacks". The headline invites a simple reading: that hacking skill in open models just got held back. Moonshot's own chart does not support that reading.

The trim lowers this one release, but it does not keep hacking skill out of open weights: an open model anyone can download today already scores above it on Moonshot's chart, and Moonshot says it will raise the ceiling.

The trim has a price, but outsiders can only partly check it

Moonshot cut cyber capability from this release and published the size of the cut. That gives the claim a number to test, but every number in the post comes from Moonshot's own benchmark, so it needs context before anyone repeats it.

Ask three questions of any pre-release safety cut: who measured it, against what baseline, and who can re-check.

Apply them here. Moonshot measured the cut on xdev-bench-hard, which it describes as "our in-house benchmark". The baseline is Moonshot's own untrimmed checkpoint, a version of the same model built without the cut. After Nov 4, anyone with the hardware can download K3.1 Pro and test the shipped model's absolute skill on their own tests. They cannot re-check the size of the trim, because the untrimmed checkpoint may never ship and the benchmark is in-house. That limit is our inference, not something Moonshot states.

The reason this matters beyond one model: Moonshot attached a measured capability price to an open-weights release, which gives the public a number to argue about. Moonshot also chose the threshold, ran the test and decides when to raise it.

Moonshot removed cyber data at both training stages and kept the coding

The hard part of this edit is that the cyber material was already mixed into the broad data. Moonshot's post reports that "we found that cyber-related content was embedded within the general mid-training corpus", and that cyber-related tasks were present in the RL environment mix, which it calls "a natural byproduct of training on broad data". Mid-training is a stage where the model trains on a broad body of text. The RL environment mix is the set of practice tasks the model is rewarded for solving.

Moonshot says leaving the material in would have shown up in the result: "without data removal at either the mid-training or the RL stage, downstream cyber capability would increase substantially."

So for the open release, the lab did two things at once. Moonshot "identified and removed cyber-related data from both training stages, while retaining the general-purpose coding tasks needed for model usefulness". The model got taught less hacking and drilled on less hacking, while the coding practice that makes it useful stayed in.

The 9.5-point price, and what it probably means in tasks

Moonshot describes xdev-bench-hard as "our in-house benchmark of expert-curated, source-code-based vulnerability discovery and exploitation tasks". The tasks reproduce recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL, with mitigations enabled, meaning the software's built-in exploit defenses are switched on. The agent gets the vulnerable code, a short bug hint and the binary, and then "the agent must develop an exploit, achieve arbitrary code execution in a separate sandbox, and retrieve a secret string for automated verification". Moonshot reports the results as pass@3: the model gets three attempts per task, and any one success counts.

Here is the chart, as Moonshot labels it:

GPT-5.6 Sol, scored by a third party, tops the table at 100, above even the untrimmed Kimi checkpoint.

Moonshot does not say how many tasks the benchmark has, so this part is our inference from the chart. Every score in the table is a multiple of 1/21: 19/21 is 90.5, 18/21 is 85.7, 17/21 is 81.0, 12/21 is 57.1 and 7/21 is 33.3. That is consistent with a benchmark of at least 21 tasks, or a multiple of 21. On that reading, the 9.5-point trim is about two tasks, and DeepSeek's lead over the trimmed Kimi is about one. The argument below is about what the cut can and cannot do, not about how big it is.

Moonshot's own summary of the gap is that "data removal meaningfully reduces cyber capability relative to what the same training pipeline would otherwise produce". Read as misses instead of successes, the model went from failing 9.5% of problems to failing 19%, roughly double, which on our 21-task reading is about two tasks becoming about four. Moonshot calls the reduction meaningful, and on a sample this small both gaps are indicative, not conclusive.

An open model already scores above the trimmed release

DeepSeek-V4.1-Flash scores 85.7, above the trimmed K3.1 Pro's 81.0. That model is not hypothetical. Its Hugging Face page, the main site for sharing model files, states that "This repository and the model weights are licensed under the MIT License", which allows anyone to use and modify the weights. The page showed 95,889 downloads last month, and its model tree lists 55 finetunes (versions other people retrained) and 142 quantizations (compressed versions). Anyone can fetch it today, as we did on Oct 27.

One caution: the post does not say who ran the DeepSeek evaluation, so the 85.7 is a Moonshot-published figure like the rest.

Moonshot's stated bar names "frontier proprietary models", so the open-model comparison is the chart's own addition and not a broken promise. The first of its two principles reads: "we aim not to release open weights that would extend the absolute frontier of cyber capability". The post adds that K3.1 Pro's offensive cyber capability "remains behind that of frontier proprietary models". What the chart shows is narrower: the trim holds this release under a line that another open release already crossed, by about one task on our reading. That is why the headline's "curbs" does not describe open weights as a whole.

The ceiling is scheduled to rise, and the cut erodes on its own

Kimi K3, the predecessor, scores 33.3 in the table, and K3.1 Pro, with the trim already applied, scores 81.0. Moonshot explains the jump in its own words: K3.1 Pro "improves substantially over its predecessor, indicating that stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal." So the cut does not compound. Growth in general coding skill eats into it.

The second principle in the same post reads: "we intend to progressively raise the cyber capability available in open weights." Moonshot puts the ceiling and the plan to raise it back to back, and it sets the schedule.

The yardstick will also change. Moonshot says "We will keep evolving our internal benchmarks so that evaluation stays informative." In our reading, a future score on a revised benchmark may not line up with this table.

The strongest case for the trim

The diffusion argument deserves a fair hearing, because Moonshot makes it in its own post. The lab writes that "making K3.1 Pro available in a non-discriminatory way benefits people who need dual-use capabilities for defensive purposes." When a capable model is open and runs on infrastructure its users control, "many more teams gain the means to audit the code they maintain", including "legacy systems that rarely receive dedicated security reviews". Letting the capability spread gradually, the post argues, "rather than concentrating it in a few proprietary systems", "ultimately makes all software more secure".

That argument has weight for a reason you can see in this very chart: capability at this level already exists in open ecosystems, so withholding it from one release would change little. A weak trim is not a bad sign on that view. And a real, priced cut is genuine accountability, better than a silent release; the problem is that Moonshot enforces it on itself and has scheduled it to rise.

What the argument still owes the reader is a verifier. Gradual diffusion describes where the capability ends up, and it does not tell anyone whether defenders or attackers got there first.

How to read the next pre-release safety claim

The trim lowers this one release, but it does not keep hacking skill out of open weights: an open model anyone can download today already scores above it on Moonshot's chart, and Moonshot says it will raise the ceiling.

When the next lab announces that it made a model safer before release, run the three questions (who measured, against what baseline, who can re-check) and ask for the answers in writing. Treat a missing one as the gap in the claim.

On Nov 4 anyone can download K3.1 Pro and test its absolute skill. No download will show the 9.5-point trim itself, because the untrimmed checkpoint may never ship. That is our inference. Watch whether Moonshot publishes the baseline.

Sources

fetched Oct 27, 2026; the Reuters article body is paywalled, so we verified its headline and URL

1. Moonshot, Introducing Kimi K3.1 Pro (Oct 23): the removal mechanism, the xdev-bench-hard chart, the two principles, the erosion statement, the diffusion argument.
2. Hugging Face, DeepSeek-V4.1-Flash-1017: MIT license, downloads, finetune and quantization counts.
3. Reuters, Moonshot curbs hacking ability in new Kimi model (Oct 24): the headline.