Moonshot shipped a model it made worse on purpose

Moonshot put a four-digit Hacker News thread behind a model release on October 23. The thread is about Kimi K3.1 Pro, the first model in the K3.1 series and, by Moonshot's own description, the most capable 3T-class open-weight model to date. A debut that size usually ends the conversation. The part worth reading sits further down the same post, in the cybersecurity section: Moonshot trained a stronger cyber capability into this model, measured it, then pulled that capability back before shipping the open weights.

What shipped: K3.1 Pro and a Highspeed variant that runs two to three times faster. Both are live on kimi.ai and the Kimi API now; full weights follow by November 4. The model is a post-trained K3 with substantially more post-training compute, and Moonshot says it rebuilt the RL framework, the long-context inference path, and the sandbox infrastructure to run joint RL across hundreds of downstream domains. The headline spec is a 1-million-token context window.

The removal story starts with a trend the team did not like. Vulnerability-research performance kept climbing as post-training scaled. Tracing it back, they found cyber content mixed into the general mid-training corpus and cyber tasks sitting in the RL environment mix, a byproduct of training on broad data. In preliminary experiments, models that kept that data gained cyber capability substantially as training scaled. So for the open-weight release, Moonshot identified and stripped cyber-related data from both stages while keeping the general-purpose coding work.

Then they published the counterfactual, which is the rare part. On xdev-bench-hard, Moonshot's source-code exploit benchmark, the checkpoint without the data removal solves 90.5 percent of tasks at pass@3. The shipped K3.1 Pro solves 81.0 percent. That 9.5-point gap is the price of the cleanup, printed in their own chart. Labs almost never quantify what they deleted from their own model.

The rest of the benchmark table reads like a bid for frontier parity: 65.7 percent on Terminal-Bench 4.0, ahead of GPT-6 Astra at 58.2 and about a point behind Claude Opus 5.5, all vendor-reported under their stated harnesses. Artificial Analysis scored K3.1 Pro at 55 on its Intelligence Index when the model launched, fourth overall and the highest open-weights entry on the board. The same page now reads 46 and ninth after the v5 rebaseline late in October. The vendor number will keep moving under them; the capability gap is the part that holds. Verification comes later.

The safety section states the principle plainly: no open-weight release should extend the absolute frontier of cyber capability, and whatever capability does ship should rise progressively. Moonshot's argument for releasing at all is the audit one. When capable models run on infrastructure users control, more teams can audit the code they maintain, including legacy systems that rarely see a security review. Read it next to OpenAI locking down its own frontier training environment, announced the same day as this release, and you get both halves of the current debate: containment on the proprietary side, capability pruning on the open side. The containment half got its own dataplane when NVIDIA shipped a kernel-level agent runtime. This is the other half arriving.

The honest tension is that data cleaning is a lever you pull once per generation. K3.1 Pro still solves far more of xdev-bench-hard than K3's 33.3 percent, because general coding and long-horizon debugging skill flows into vulnerability research even after the cyber data leaves the corpus. Every generation of general capability will leak into cyber capability, and the filter buys less each time. Moonshot's post concedes as much, promising the controls will keep evolving at every training stage.

November 4 is the date to watch. The weights land, the license terms land with them, and anyone with the hardware gets to measure the gap between what Moonshot built and what Moonshot ships. Their own chart already gave us the summary: 90.5 exists, 81.0 ships.