Moonshot releases Kimi K3.1 Pro and says it removed cyber data before an open release

Moonshot AI released Kimi K3.1 Pro, a post-trained successor to Kimi K3, through the Kimi apps, Kimi Code and its API, with a second tier, K3.1 Pro Highspeed, that it says runs two to three times faster. Its launch post gives a one-million-token context window and says “full model weights will be released by Nov 4, 2026”. It describes the model only as “3T-class” and names no licence for the weights, which had not been published at the time of writing.

Performance claims are Moonshot’s own. The post reports 65.7% on Terminal-Bench 4.0, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra, and 64.4 on OfficeQA Pro v2, which it calls state of the art. Simon Willison reported the API price at $2.00 per million input tokens and $10 per million output tokens, and an Artificial Analysis index score of 55. He called it the first time a soon-to-be open-weight model had scored this highly against the frontier. The accounts differ on ranking: Willison placed it behind only Claude Opus 5.5 (58), while The Decoder, citing the same index, put it fourth behind Opus 5.5, Claude Sonnet 5.5 and Muse Wonder Full. The Decoder also reported that K3’s price had been $3 and $15, and that parameter count was unchanged at 2.8 trillion.

The post’s cybersecurity section is the unusual part. Moonshot wrote that, as post-training scaled, vulnerability-research performance kept rising, and that it traced this to cyber-related content in the general mid-training corpus and cyber tasks in the reinforcement-learning mix. For the open-weight release it removed both while keeping general coding tasks. On xdev-bench-hard, an in-house set of exploit-development tasks reproducing disclosed bugs in software such as the Linux kernel and Node.js, scored pass@3, Moonshot said a checkpoint without the removals solved 90.5% and the final model 81.0%. In its chart K3 scored 33.3 and GLM-5.3 57.1.

Moonshot drew two conclusions: that data removal “meaningfully reduces cyber capability”, and that general coding gains still carry over to cyber tasks, since K3.1 Pro improves substantially on K3. It said the model remains behind proprietary frontier models available for at least three months, that it aims not to release weights that extend the cyber frontier, and that it intends to “progressively raise” the cyber capability of its open weights. The benchmark and the comparison are Moonshot’s, with no outside evaluation. The post reports no test of whether the filtering survives further fine-tuning of the released weights.

Earlier cyber assessments of Chinese open models came from outside the developers: UK and US government evaluators on Kimi K3 and Anthropic’s red team on a Zhipu model. Here the developer set out its own limit before release. Whether the weights ship by 4 November, and what independent testing finds, is the follow-up.