Moonshot Opens Kimi's Weights, and Strips Its Cyber Skills

Moonshot AI has put the weights of its Kimi K3.1 Pro model online, and the release carries a detail that deserves more attention than the benchmark bragging around it. Before handing the model to the public, the company says it pulled cyber-related material out of the training, on purpose, so the open version would be less capable at hacking than the one it runs behind its own API.

The model itself first appeared through Moonshot's API on October 23, with a one-million-token context window and a faster companion the company calls K3.1 Pro Highspeed. The weights followed on November 4, landing on Hugging Face. On paper that puts a frontier-class Chinese model in anyone's hands, which is the part that tends to draw the headlines.

The benchmark question

How good is it, really? That depends on who is holding the scorecard. Moonshot's own numbers are flattering. On Terminal-Bench 4.0, the company puts Kimi K3.1 Pro at 65.7 percent, within a whisker of Claude Opus 5.5 at 66.4 percent, and one tracker counted it ahead of Opus on 16 of 37 tests. Moonshot is candid that several of these evaluations are internal, and that some were run on H20 chips rather than the H100s used elsewhere, which muddies any direct comparison.

Outside testers are less impressed. Artificial Analysis scored the model at 55 against Claude Opus 5.5's 58. Vals placed it eighth of 27 models on its index, at 62.52 percent. That is a capable open model, priced aggressively at two dollars per million input tokens and ten per million output. It is not the Opus-killer the vendor charts imply. The gap between a lab's own numbers and an independent run is a familiar story, and it is a good reminder to read the fine print under any leaderboard, including the ones from labs I would otherwise trust.

Removing a capability on purpose

The cyber decision is the genuinely novel move. Moonshot stripped cyber data from the mid-training and reinforcement-learning stages before the open-weight release, which is why the public model is deliberately worse at offensive security than it could be. For a company shipping open weights, this is close to the only lever it has. Once the file is downloaded it cannot be recalled, so any guardrail has to be baked in before the door opens.

It is a quiet admission of something the open-weights debate often talks around. Openness and safety pull against each other, and the resolution here was to make the model less able rather than to lock it down after the fact. Whether a determined user can fine-tune the caution back out is the obvious next question, and nobody has a clean answer to it.

Kimi K3.1 Pro joins a crowded autumn for open releases, from Mistral opening its trillion-parameter model to a free 33-billion model aimed squarely at coding agents. It is worth remembering, as the word "open" gets thrown around, that open weights and open source are not the same thing, and Moonshot's licensing terms are still being read for exactly what they permit. What sets this one apart is not the size or the score. It is a lab choosing, before release, to hand over a little less power than it had.