Moonshot AI curbs hacking ability in Kimi K3.1 Pro model

Moonshot AI just did something unusual for an AI lab: it made its newest model deliberately worse at one thing.

The Beijing-based startup said on Saturday that it has reduced the cyber-offensive capabilities of Kimi K3.1 Pro, its most advanced model to date. The decision lands as worries mount that increasingly autonomous AI systems could supercharge hacking.

The method was blunt but effective. Moonshot stripped cyber-related data out of the model’s training corpus before release, aiming to limit its ability to exploit software vulnerabilities while keeping its coding skills intact.

What Moonshot actually changed

The numbers show how that trade-off played out. On Moonshot’s internal exploit benchmark, Kimi K3.1 Pro scored 81.0%.

An unfiltered version of the same model, trained with the cyber data left in, scored 90.5%. So the filtering shaved roughly nine and a half percentage points off its offensive performance.

The comparison with the previous generation is starker. The earlier Kimi K3 model scored just 33.3% on the same test.

Read plainly, the filtered model is still far more capable at exploitation than its predecessor. Moonshot didn’t freeze its hacking skills in place. It slowed the climb.

The company has framed the goal in measured terms. Moonshot said it does not intend for this model to push the boundaries of cyber-offensive capability, and it plans incremental improvements to defensive safeguards in future releases.

The specs behind the safeguards

Kimi K3.1 Pro is a large model by any standard. It uses a mixture-of-experts architecture with 2.8 trillion total parameters, of which 104 billion are active at any given time.

The model also carries a 1-million-token context window. That gives it room to process very long documents or sprawling codebases in a single pass.

On the coding side, Moonshot appears to have preserved what it set out to protect. Kimi K3.1 Pro scored 65.7% on Terminal-Bench 4.0, a result comparable to Anthropic’s Claude Opus 5.5.

The model reportedly also showed reduced hallucination rates.

Then comes the part that raises the stakes. Moonshot plans to publicly release the full model weights by November 4, 2026.

Why the open-weight release changes the calculus

Most frontier AI labs keep their models behind an API. Users send requests, the company sends answers, and the company can monitor, throttle, or patch behavior along the way.

Open weights work differently. Once the files are public, anyone can download the model, run it on their own hardware, and modify it. There is no recall button.

That context explains why Moonshot reached for data filtering rather than relying only on post-release controls. If a capability never enters the model during training, there is less of it sitting in the weights for others to coax back out.

The move also follows scrutiny of Kimi K3, which drew attention for its performance on cyber tasks. Moonshot’s latest release reads partly as a response to that attention, an attempt to show it can ship a stronger model without handing out a sharper attack tool.

What this means for the AI industry

The biggest takeaway is that Moonshot is putting a number on safety trade-offs, and publishing it. Showing a filtered score next to an unfiltered one makes the cost of caution visible.

There is a competitive dimension too. Kimi K3.1 Pro posted coding results comparable to Claude Opus 5.5 on Terminal-Bench 4.0, which puts an open-weight Chinese model in the same conversation as a leading closed US system on that benchmark.

The next checkpoint is November 4, 2026. Once the weights are public, researchers and security teams will be able to test Moonshot’s claims independently, and see whether a curated training diet is enough to keep a 2.8 trillion-parameter model on its best behavior.