A build of Moonshot AI’s newest model that was trained without any cyber-data filtering solved 90.5% of the company’s in-house exploit tasks. The version Moonshot released, Kimi K3.1 Pro, solves 81.0%.
Moonshot reported both numbers in the cybersecurity section of its technical blog post for Kimi K3.1 Pro, posted Friday afternoon U.S. time alongside a faster sibling, K3.1 Pro Highspeed. The Chinese startup says it removed cyber-related data from training for the model’s open-weight release, and the 9.5-point gap is its own measure of what that removal took away.
How close it gets to GPT-6 Astra and Opus 5.5
Moonshot calls K3.1 Pro its most capable 3T-class open-weight model. Its launch post on X lists 2.8 trillion total parameters with 104 billion active, in a multimodal mixture-of-experts design with a 1-million-token context window. It is a post-trained version of K3, built with what the company describes as substantially larger post-training compute and reinforcement learning across hundreds of domains.
On Terminal-Bench 4.0, which grades coding agents on terminal tasks with strict per-task tests, Moonshot reports 65.7% for K3.1 Pro. It puts OpenAI’s GPT-6 Astra at 58.2% and Anthropic’s Claude Opus 5.5 at 66.4%. The company also claims a top score of 64.4 on OfficeQA Pro v2, a test of analysis across real financial documents, and 92.7% with tools on BenchCAD, where Opus 5.5 scored 96.2% and GPT-6 Astra 95.9%. These are Moonshot’s numbers. Its footnotes say K3.1 Pro ran inside Claude Code for most coding tests, while many rival scores were taken from public leaderboards or the rivals’ own reports.
Nathan Lambert, who writes the Interconnects AI newsletter on open models, wrote on X that the benchmark scores “look to be clearly the strongest current open weight model, if the weights are released as they claim by November 4th.” In a second post he said “it looks like they figured out their RL, where the initial release was a very impressive base model with lighter post-training.”
Why Moonshot pulled the hacking data
Moonshot says its vulnerability-research scores kept rising as post-training scaled up. When engineers traced the cause, they found cyber content mixed into the general mid-training corpus and cyber tasks sitting in the reinforcement-learning environments. For the open-weight release they removed both and kept the general coding tasks.
The yardstick is xdev-bench-hard, an internal suite. Most of its tasks recreate recently disclosed bugs in software such as the Linux kernel, Node.js and Exim, with mitigations on, and give the agent the vulnerable source code, a short hint and the binary. To pass, the agent has to write an exploit that gets arbitrary code execution in a separate sandbox and pull out a secret string. The checkpoint trained without the filtering hit 90.5% at pass@3. Even after the cut, the final model scores well above its predecessor, which Moonshot attributes to general coding and debugging skill carrying over into cyber work.
“K3.1 Pro’s cyber capability remains behind that of frontier proprietary models that have been publicly available for at least three months,” the company wrote. Its stated principle is that “we aim not to release open weights that would extend the absolute frontier of cyber capability.” Moonshot also says it intends to raise the cyber capability in its open weights over time, so that more teams can audit the code they maintain, legacy systems included, on infrastructure they control.
The argument it walks into
Anthropic and OpenAI have both made the security case against downloadable models in recent weeks. Anthropic published a report in late September arguing that GLM-5.3, an open model from China’s Z.ai, posed a major cyberattack risk, mainly because anyone can download and modify it, as WebProNews reported. On Oct. 14, OpenAI CFO Sarah Friar told Bloomberg Television, “We think you want to be on more Western models on the cyber front.” (WebProNews covered her remarks at the time.)
Moonshot’s controls apply at training time. The blog post does not address whether someone could fine-tune the released weights to put the filtered capability back.
What buyers can turn on today
K3.1 Pro is live in the Kimi apps, the Kimi Work desktop app from version 3.1.0, and Kimi Code, and through the API as kimi-k3.1-pro and kimi-k3.1-pro-highspeed, with zero data retention available to API customers. Kimi Enterprise admins have to opt in, since access is off by default. Full weights are promised by Nov. 4.
Moonshot is also pitching the model to finance teams. On an internal stress test, its claim-level hallucination rate fell from 23.4% on K3 to 8.3%. The company adds its own caveat: “The reported rates do not represent overall error rates in daily use.”