Moonshot's Kimi K3.1 Pro Ships Open-Weight, With In-House Hacking Score Cut From 90.5% to 81.0%

Moonshot AI released Kimi K3.1 Pro on 23 October 2026, the first model in a new K3.1 series and, by the company's own description, its most capable "3T-class" open-weight model, with a 1-million-token context window. A faster variant, Kimi K3.1 Pro Highspeed, runs at two to three times the speed for interactive use. Both are live now on Kimi.com, Kimi Work, Kimi Code and the Kimi API, though the full model weights are not due until 4 November 2026.

On Moonshot's own coding benchmark, Terminal-Bench 4.0, K3.1 Pro scores 65.7%, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra, according to the Kimi K3.1 Pro tech blog. Running the same benchmark independently, Artificial Analysis recorded a close but not identical 67%, up from 13% for the prior Kimi K3, and ahead of Claude Sonnet 5.5's 64% on its test setup.

Artificial Analysis also placed K3.1 Pro fourth on its Intelligence Index, a composite score drawn from multiple benchmarks, with a score of 55 — an 11-point jump from Kimi K3's 44. Only Claude Opus 5.5 (58), Claude Sonnet 5.5 (56) and Muse Wonder Full (56) score higher, per the same Artificial Analysis report, which states the model "will be the leading open-weights model once its weights are published."

Cutting cyber capability before release

The more unusual part of the launch is what Moonshot says it removed. The company's tech blog states it "identified and removed cyber-related data from both training stages, while retaining the general-purpose coding tasks needed for model usefulness," after concluding that "as K3.1 Pro became more capable, we spent a correspondingly larger share of our effort understanding where cyber capability comes from, and how much of it we can control."

Moonshot measured the effect on an in-house benchmark it calls xdev-bench-hard, described as "our in-house benchmark of expert-curated, source-code-based vulnerability discovery and exploitation tasks." A checkpoint built with no cyber-data removal and no reinforcement-learning filtering solved 90.5% of its problems at pass@3; the shipped K3.1 Pro solved 81.0%, Moonshot's blog states. The company frames this as a policy, not a one-off fix: it says it aims "not to release open weights that would extend the absolute frontier of cyber capability," while planning to "progressively raise the cyber capability available in open weights" over time.

For comparison, Moonshot's predecessor Kimi K3 solved only 33.3% of the same test. Moonshot's own tech blog shows a chart in which DeepSeek's open-weight V4.1-Flash scores higher still on xdev-bench-hard, at 85.7%, than K3.1 Pro's filtered 81.0% — a result Moonshot publishes without commenting on what it implies for K3.1 Pro's relative cyber capability.

An unverified safety claim

Because xdev-bench-hard is not public, the 90.5%-to-81.0% reduction cannot currently be checked by anyone outside Moonshot. Reporting on the release in Implicator.ai, Marcus Schuler cites the AI analysis site Extrapolator's assessment that "the cybersecurity removal story is the most uncertain claim in the release," adding that the boundary of what counts as cyber-related content "is fuzzy by definition, and the mitigation functions as a filtering heuristic rather than a principled capability boundary." The same Implicator.ai report notes that Moonshot's documentation does not state whether later fine-tuning by a downstream user could restore the removed capability.

Where the hallucination numbers diverge

A similar pattern shows up in factual-accuracy claims. On Moonshot's own "Kimi Hallu Bench Hard" test, the tech blog reports the claim-level hallucination rate falling from 23.4% for K3 to 8.3% for K3.1 Pro. Artificial Analysis ran its own AA-Omniscience evaluation and found a smaller change: a hallucination rate of 53% for K3 falling to 44% for K3.1 Pro, with accuracy rising from 48% to 51%. Both tests point the same direction — fewer false claims in K3.1 Pro — but the size of the improvement depends heavily on which test is doing the measuring, and only the Artificial Analysis figures come from a benchmark run outside Moonshot.

What it means for developers and researchers

For engineers choosing an open-weight model, K3.1 Pro's combination of a 1-million-token context window, competitive agentic coding scores and a pending Apache-style weight release on 4 November 2026 makes it a serious option once those weights land. For security researchers, the more consequential change is that a major lab is now reporting it filters offensive-cyber content out of training data and reinforcement-learning environments before publishing weights, and is saying so publicly instead of leaving the policy implicit.

Whether that filtering actually holds up is an open question. Until Moonshot publishes xdev-bench-hard or an outside group replicates the test on the released weights, the 81.0% figure is a claim from the model's own maker, not an independently confirmed ceiling on what K3.1 Pro can do against real vulnerabilities — a distinction worth keeping in mind for anyone building agentic coding or security tooling on top of it.