Moonshot said it intends to “progressively raise the cyber capability available in open weights” after its new Kimi K3.1 Pro model scored 81% in an in-house hacking test, according to the company's official announcement. A separate build trained without the company's cyber-data cuts scored 90.5% — a 9.5-point gap that, by the company's numbers, captures the effect of those cuts on the benchmark.

The Beijing-based startup will release the full weights for K3.1 Pro by Nov. 4, meaning anyone will be able to download the model's trained parameters and run it on their own hardware. The model is already deployed on Kimi.ai and the Kimi API, where it runs with a context window of 1 million tokens. Moonshot also offers a high-speed version that is two to three times faster, the company said.

Cyber-data cuts shaped the open release

Moonshot tied the model's expanding exploit capabilities to cyber material in its general mid-training corpus and its reinforcement learning tasks. The company's early experiments found that retaining that data in either stage would significantly heighten downstream cyber capability. For the open release, Moonshot removed the data from both stages while keeping the general coding tasks.

The xdev-bench-hard test asks an agent to exploit recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, and Exim. Each task comprises the vulnerable source code, a short hint about the bug, and the binary. A task is deemed solved only if the agent can run arbitrary code in a sandbox and retrieve a secret string.

K3.1 Pro far outscored its predecessor, Kimi K3, which managed only 33.3%. Moonshot's chart places DeepSeek-V4.1-Flash at 85.7% and GLM-5.3 at 57.1%, though both were running on another harness, so those figures are not directly comparable to K3.1 Pro's result. The company said K3.1 Pro's cyber skills lag publicly available frontier proprietary models by at least three months. None of the scores have been independently corroborated.

No extension of the hacking frontier

“We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said.

Moonshot regards the gradual rollout — beginning with the weights due by Nov. 4 — as a defensive measure. Companies that run an open model on their own infrastructure are able to audit the code they maintain, including legacy systems that are seldom security reviewed, the company said. Policing open weights is harder: once the files are disseminated, the developer loses much of its ability to control access, monitor use, or update safeguards.

The release comes amid tightening scrutiny of AI-driven cyber tools. Last week, China proposed export controls that would prohibit the export of technology to generate malware using AI and curtail tools that aid in identifying vulnerabilities using AI. The draft remains open for public comment, leaving its final scope unsettled. Also this week, Cryptopolitan reported that Microsoft tied the China-linked group Storm-0940 to a ConnectWise breach via ARTEX, an open-source penetration-testing framework that supports any AI model.

Broader benchmark results

Outside the cyber domain, Moonshot said K3.1 Pro scored 65.7% on Terminal-Bench 4.0, ahead of OpenAI's GPT-6 Astra at 58.2% and narrowly behind Anthropic's Claude Opus 5.5 at 66.4%.

On the company's internal stress test for made-up facts, the claim-level hallucination rate — a count of how often individual statements in the model's output are fabricated — dropped from K3's 23.4% to 8.3%.

According to Cryptopolitan, Moonshot's founders face a ~$700 million arbitration claim from shareholder Recurrent AI ahead of the company's planned Hong Kong IPO.