Kimi K3.1 Pro Arrives With Deliberately Capped Cyber Skills

Moonshot AI released Kimi K3.1 Pro on Saturday, the first model in a new K3.1 series and, by the company's own description, its most capable 3T-class open-weight system, with a 1,048,576-token context window. The launch carries an unusual footnote: Moonshot deliberately stripped cyber-related data out of training so that the open weights, due November 4, would not extend the offensive-security frontier.

What actually shipped

K3.1 Pro is a post-trained version of Kimi K3 with substantially more post-training compute. Moonshot reports 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra at 58.2% and just behind Claude Opus 5.5 at 66.4%, plus 61.2% on its internal Kimi Code Bench 3.0 Long-horizon, up from 55.95% for K3. BenchCAD reaches 92.7% with tools and OfficeQA Pro v2 hits 64.4. On the company's hallucination stress test, the claim-level error rate fell from 23.4% under K3 to 8.3%.

A Highspeed variant delivers the same capabilities at roughly two to three times the speed. Both are live now on Kimi.com, Kimi Work, Kimi Code and the Kimi API, with full weights promised by November 4. API pricing is $2 per million input tokens and $10 per million output, against $3/$15 for K3, with cached input at $0.20 per million.

The cyber decision is the real story

The second half of the release is the part worth reading closely. Moonshot traced rising vulnerability-research performance to cyber content buried in its mid-training corpus and cyber tasks sitting in its RL environment mix, then removed both for the open-weight build while keeping general-purpose coding tasks intact.

On its in-house xdev-bench-hard, a set of exploitation tasks built on real disclosed bugs in the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL with mitigations enabled, the checkpoint trained without those controls solves 90.5% of problems at pass@3. Final K3.1 Pro solves 81.0%. Moonshot states plainly that it does not aim to release weights that extend the absolute frontier of cyber capability, and that it intends to raise that capability gradually instead.

What this means for builders

Two practical signals. First, agentic coding economics keep sliding in the buyer's favour: a 1M-context model that trades blows with Opus 5.5 on terminal work now costs a third less than its own predecessor, which changes how many agent steps fit inside a fixed budget.

Second, open weights are no longer a neutral capability dump. A lab can and will shape what an open checkpoint can do before it leaves the building, and that shaping happens inside the training pipeline, not the licence text. Teams picking a base model for security tooling, code review or autonomous patching should expect future open-weight flagships to be deliberately uneven: strong on engineering, throttled on offence. That is a different kind of evaluation problem than raw benchmark scores, and it sits closer to the isolation questions around agent sandboxes such as Google's keyless microVM approach than to model shopping.

One deployment note: Kimi Enterprise administrators have to enable K3.1 Pro for their organisation, because access is off by default at launch.