Moonshot says it trained down its new Kimi model's hacking skill, but its own test shows a small cut

In the tech blog for Kimi K3.1 Pro, Moonshot AI published the score of a model it chose not to release. The test is its own: give the AI vulnerable source code and a short hint, and ask it to write an exploit that gains arbitrary code execution on a separate machine, with three attempts per task. Trained the ordinary way, the model solved 90.5%. The version Moonshot shipped solved 81.0%.

• GPT-5.6 Sol100
• Kimi, unfiltered build (unreleased)90.5
• DeepSeek V4.1 Flash85.7
• Kimi K3.1 Pro (released)81.0
• GLM-5.357.1
• Kimi K333.3

Source: Moonshot AI, Kimi K3.1 Pro tech blog, October 2026

The difference is training data. According to the blog, the team watched the model’s skill at finding and exploiting bugs climb steadily as post-training scaled up. They traced it to cyber-related material sitting inside the general mid-training corpus, and to hacking tasks in the mix of reinforcement-learning environments. So they removed both, keeping ordinary programming work. Moonshot attached two principles: it aims “not to release open weights that would extend the absolute frontier of cyber capability”, and it intends to raise the cyber capability of its open weights gradually, because a capable model that people run on their own machines lets many more teams audit the code they maintain, including old systems that rarely get a security review. The full weights are due by 4 November, after which anyone can download and modify them.

Every score in the table is an exact number of twenty-firsts, which suggests the unpublished test has 21 tasks. On that reading, the unfiltered build solved 19 and the released model 17. Removing the data cost two tasks.

The third row is DeepSeek V4.1 Flash, released under the MIT licence on 17 October and free for anyone to download. It solved 18: one more than K3.1 Pro, one fewer than the unfiltered build. The previous Kimi model, K3, solved 7. OpenAI’s GPT-5.6 Sol, released in July, solved all 21 in a third-party run, which fits Moonshot’s claim that K3.1 Pro “remains behind that of frontier proprietary models that have been publicly available for at least three months”. By Moonshot’s own numbers, then, the cut keeps K3.1 Pro from being the most capable downloadable model at writing exploits, a place now held by DeepSeek’s week-old release. Against its own predecessor, its exploit-writing still more than doubled.

The blog compares filtered and unfiltered builds on this one test only; its other 46 results cover the released model alone, so it does not show whether the removal cost anything elsewhere. Outside data suggests no cost on the defensive side. The independent evaluator Artificial Analysis runs a cyber index that asks models to find, reproduce and patch vulnerabilities in real codebases, and K3.1 Pro has the highest score of any publicly available model it has tested. Claude Opus 5.5 and GPT-6 Astra score low mainly because on one of the three tests, which requires reproducing a vulnerability, their own safety systems blocked almost every task, and a blocked task scores zero. K3.1 Pro had no tasks blocked.

• Kimi K3.1 Pro64
• DeepSeek V4.1 Flash 101757
• Kimi K341
• GPT-6 Astra33
• Claude Opus 5.529

Measured independently by Artificial Analysis across three defensive tests. Tasks declined by a safety system score zero, which explains most of the closed models' low scores. Source: Artificial Analysis Cyber Index, checked 24 October 2026

Whether someone can train the removed skill back once the weights are out is a question nobody can answer yet. The removal happened only in mid-training and reinforcement learning. K3.1 Pro is a further-trained K3, so whatever K3 absorbed in pre-training is untouched, and K3’s weights are already public. The closest research is a 2025 paper by researchers at the UK AI Security Institute and other groups: filtering biothreat text out of the pre-training data let small 6.9-billion-parameter models withstand up to 10,000 steps of malicious fine-tuning, whereas safeguards added late in training often fail within a few dozen steps. Moonshot’s approach sits between the two, on a model hundreds of times larger, so the paper’s result does not carry over. Neither the weights nor the test set is public yet; Moonshot’s Hugging Face page has no K3.1 Pro, so outsiders cannot even check the two-task gap.

K3’s licence explicitly allows anyone to fine-tune it. The barrier is hardware: the K3 repository on Hugging Face is about 1.56 TB, and retraining at that scale takes a whole computing cluster. For those who have one, Ensar Seker, chief information security officer at a threat-intelligence company, was blunt in his security newsletter on 23 October: “Adversaries do not need Moonshot’s unreleased checkpoint: fine-tuning, jailbreaks, or simply last month’s unfiltered competitor can restore what was cut.”

Twelve days earlier, Anthropic published a post on how it defends against “distillation”, meaning the use of large numbers of accounts to query Claude and train another model on its answers and reasoning, and it named two Chinese companies. It said Zhipu distilled the cyber capabilities of US models while developing GLM-5.3, and that Moonshot secretly forwarded requests from Kimi users to Claude, one of them from a user Anthropic believes was linked to China’s People’s Liberation Army, who wanted CCTV footage of a specific person analysed. Its September threat report goes further: over one ten-day period, it says, Moonshot relayed almost 300,000 customer requests to Anthropic through 5,380 fraudulent accounts. All of this comes from Anthropic’s own logs, which outsiders cannot check. Moonshot’s public position on distillation dates from July, after K3’s launch, when Huang Zhenxin, head of its enterprise business, said according to the Chinese outlet TechWeb that K3’s gains came from original architecture work rather than distillation. The K3.1 Pro blog does not mention the matter.

Anthropic’s defence against distillation runs through its own API: Claude’s reasoning is summarised before people see it, and requests that try to extract it are blocked. Anthropic estimates this has cut the reasoning harvested by distillers by around 90 to 99%. A lab that releases weights has no API to guard once the model is out, so all Moonshot can do is teach it a little less in training and write down how much less.

For users, the immediate change is a cheaper Kimi. Through the international API, K3.1 Pro costs $2 per million input tokens and $10 per million output tokens, down from $3 and $15 for K3, though still more than ten times DeepSeek V4.1 Flash at its off-peak rate of $0.15 and $0.60. The model is live on the Kimi website and apps, Kimi Work and Kimi Code. Kimi Code’s documentation says it needs at least a Plus membership, with the 1-million-token context and the two-to-three-times faster Highspeed version reserved for Pro and above; for the chat app, Kimi’s help centre still describes K3. On launch night, a free user on a Chinese developer forum posted a screenshot saying they “still can’t use it”.