Moonshot says it intends to “progressively raise the cyber capability available in open weights” after its new Kimi K3.1 Pro model scored 81% in an in-house hacking test.A build trained witho
Moonshot says it intends to “progressively raise the cyber capability available in open weights” after its new Kimi K3.1 Pro model scored 81% in an in-house hacking test.A build trained without the company’s cyber-data cuts scored 90.5%.
The Beijing startup will release full weights for the K3.1 Pro by Nov. 4. The model is already deployed on Kimi.ai and Kimi API with a context window of 1 million tokens.
There’s a high-speed version that’s two to three times faster, the company said.
Moonshot connected the model’s expanding exploit capabilities to cyber material in its general mid-training corpus and its reinforcement learning tasks.
Moonshot’s early experiments discovered that retaining the data in either stage would significantly heighten downstream cyber capability. For the open release, it took that data out of both stages and kept the general coding tasks.
In the xdev-bench-hard test, the agent is asked to exploit recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, and Exim.
Each task comprises the vulnerable source code, a short hint about the bug and the binary. A task is deemed solved only if the agent can run arbitrary code in a sandbox and retrieve a secret string.
K3.1 Pro still far outscored its predecessor, Kimi K3, which managed 33.3%. Moonshot’s chart has DeepSeek-V4.1-Flash at 85.7% and GLM-5.3 at 57.1%, but they were both running on another harness.
Moonshot’s xdev-bench-hard results for Kimi K3.1 Pro and rival models, from the company’s K3.1 Pro blog.
The company said K3.1 Pro’s cyber skills lag frontier proprietary models publicly for at least three months. None of the scores have been independently corroborated.
“We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said.
Moonshot regards the slow rollout as a defensive weapon. Companies that run an open model on their own infrastructure are able to audit the code they maintain, which includes legacy systems that are seldom security reviewed, the company said.
Policing open weights is harder. Once the files are disseminated, the developer loses much of its ability to control access, monitor use, or update safeguards.
Last week, China proposed export controls that would prohibit the export of technology to generate malware using AI and curtail tools that aid in identifying vulnerabilities using AI. The draft is still open for public comment.
Cryptopolitan reported this week that Microsoft tied China-linked group Storm-0940 to a ConnectWise breach via ARTEX, an open-source penetration-testing framework that supports any AI model.
Moonshot pushed the model harder outside cyber. The company said the K3.1 Pro scored 65.7% on Terminal-Bench 4.0, ahead of OpenAI’s GPT-6 Astra at 58.2% and narrowly behind Anthropic’s Claude Opus 5.5 at 66.4%.
For Moonshot’s internal stress test on made-up facts, the claim-level hallucination rate dropped from K3’s 23.4% to 8.3%.
According to Cryptopolitan, Moonshot’s founders have a ~$700 million arbitration claim from shareholder Recurrent AI ahead of the company’s planned Hong Kong IPO.
If you're reading this, you’re already ahead. Stay there with our newsletter.
