Moonshot Cuts Kimi K3.1 Pro's Hacking Skills Ahead of Open Release and China Export Rules

A weaker hacking score, but a stronger model

Beijing startup Moonshot AI says it cut the offensive hacking abilities of Kimi K3.1 Pro before a planned release of its model files by November 4, 2026. The changes lowered its score on an internal software exploitation test from 90.5% to 81.0%, although the resulting model still scored far above its predecessor's 33.3%.

Moonshot released K3.1 Pro on October 23 and outlined the curbs in a statement on October 24. Its approach is to remove material used to teach certain cyber skills while keeping the general programming abilities that make the model useful for building and repairing software.

The announcement comes eight days after China's Ministry of Commerce and Ministry of Science and Technology proposed new technology export controls. Those proposals would prohibit exports of technology for generating and modifying malicious code with AI, while restricting technology that uses AI to discover software vulnerabilities.

Moonshot's release brings those two issues together: how much hacking ability a widely downloadable model should have, and how governments should regulate technology that can help both software defenders and attackers.

Moonshot, explaining its intended boundary for the release, said:

We aim not to release open weights that would extend the absolute frontier of cyber capability.

The company's weights are the files containing what the model has learned. Publishing them allows outside developers to run and modify the system on their own computers. That gives users more control, but leaves Moonshot with less ability to manage access or change safeguards after copies spread.

What Moonshot removed

Moonshot says cyber material had entered the model's development through two routes: a general training collection used during an intermediate training stage, and cyber tasks included in reinforcement learning environments. Reinforcement learning improves a model through repeated attempts at tasks and feedback on its performance.

The company removed cyber material from both stages while retaining general coding work. Its internal test, called xdev-bench-hard, measures whether a model can reproduce recently disclosed software vulnerabilities and develop ways to exploit them, with success counted within three attempts.

The test includes vulnerabilities in software such as the Linux kernel, Node.js and JavaScriptCore. These are components used to run operating systems, server applications and JavaScript code. An exploit is a method of turning a software weakness into an action, such as gaining access or making a program behave in an unintended way.

K3.1 Pro's score fell by 9.5 percentage points after the filtering, from 90.5% to 81.0%. DeepSeek V4.1-Flash scored 85.7% on the same internal comparison, placing the filtered Kimi model below that competitor.

Kimi K3, the predecessor, scored 33.3%. The filtered successor therefore retained an advantage of 47.7 percentage points, showing how far its ability to handle these tasks had advanced even after the targeted cuts.

Why general coding still matters for hacking

Moonshot attributes the remaining cyber strength partly to improvements in general programming and debugging over long sequences of work. A model that can inspect code, follow a fault through several files and test possible repairs can also apply those skills to finding and exploiting weaknesses.

The company's release blog explained the relationship this way:

improves substantially over its predecessor, indicating that stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal.

Software defenders can use those abilities to inspect older systems that receive little attention, a benefit Moonshot cited in support of open weights. An organisation could run the model locally and examine software it is responsible for maintaining.

Attackers can use similar capabilities to search for weaknesses and automate parts of an intrusion. The practical issue is therefore broader than whether a model has seen explicitly malicious examples: useful coding skills can transfer to offensive work.

Moonshot's xdev-bench-hard test has not been published, and its results have not been independently verified. The company has also not explained whether further training by outside developers could restore the capability removed before release. Those are central questions for assessing a model whose files users will be able to modify.

What government testing found in Kimi K3

The UK Artificial Intelligence Security Institute and the US Center for AI Standards and Innovation previously examined Kimi K3, which was released on July 16, 2026, with an open weights release scheduled for July 27. Their joint cyber assessment provides an independent reference point for the predecessor.

K3 scored 32% on ExploitBench, compared with 24% for GLM-5.2. That benchmark, developed by Carnegie Mellon University, tests progress in exploiting 41 vulnerabilities in V8, the software engine that runs JavaScript and WebAssembly in Chrome.

K3 achieved arbitrary code execution on none of the 41 samples. The leading models achieved that result on an average of 20 samples. Arbitrary code execution means making a target run commands chosen by an attacker, a particularly serious outcome because it can give the attacker control.

The institutes also tested K3 on The Last Ones, a simulated corporate network containing approximately 20 computers across four network segments. The exercise has a sequence of 32 attack steps and would take a human expert roughly 20 hours to complete.

Within a limit of 100 million tokens, K3 reached step 17 on average, compared with step 11 for GLM-5.2 and 28.5 for leading US models. K3 completed the entire exercise in one of 10 attempts. The most capable models completed it in six or seven attempts out of 10.

How to understand the testing limits

The UK and US institutes said K3's safeguards allowed it to attempt exploit development and offensive cyber operations during their evaluations. Their findings place K3 above an earlier leading model with open weights, but below the strongest models they tested.

The Last Ones exercise began with initial access to the network. It contained an intentional attack route, had no active defenders or defensive tools, and imposed no penalty for behaviour that would trigger security alerts. Those conditions gave the model a structured environment in which to pursue an attack.

The institutes described the evaluations as preliminary and selective. K3's aggregate capability estimate came from one benchmark, producing greater statistical uncertainty than estimates for models assessed across a broader set of tasks.

US models with closed weights were tested with system safeguards disabled so the evaluators could measure their maximum abilities with fewer refusals. Public versions have those safeguards enabled. Readers comparing the results therefore need to consider both the model's underlying skills and the controls attached to the service used to access it.

K3.1 Pro's new 81.0% result comes from Moonshot's different internal test. Its comparison with K3 is most useful within that same test, where the predecessor scored 33.3%. An independent assessment of the new release would give security teams a firmer basis for judging its capabilities.

China proposes bans and restrictions

China's two ministries issued Announcement No. 48 on October 16, 2026. The notice seeks comments on revisions to the Catalogue of Technologies Prohibited and Restricted from Export, with submissions open through November 15.

The proposed additions cover 40 technologies: 23 in AI, five in biomedicine and 12 in solar manufacturing. Across all three fields, 14 technologies would be prohibited from export and 26 would face restrictions.

The AI categories include large models, agents, computing clusters and information processing. Agents are systems that use tools and carry out a sequence of actions toward a goal, rather than simply answering a single question.

AI technology for generating and modifying malicious code is among the proposed prohibited exports. AI technology for finding vulnerabilities is among the proposed restricted exports. The difference matters: prohibition would bar covered exports, while restrictions would place covered transfers under export controls.

The Ministry of Commerce's policy explanation says the technologies could be used against critical information infrastructure, defence industry systems and core government systems, or to bypass security protections. The ministry describes the revision as routine technology trade management that targets no particular country, region or entity.

Registration starts before the final rules

China's proposed catalogue changes remain under consultation, but temporary registration requirements took effect when the October 16 announcement was issued. Exporters must register covered technology transfers before export until the revised catalogue takes effect. Transfers already underway but not completed are included.

The notice identifies several covered arrangements: transferring technology ownership abroad, licensing domestic technology for overseas use, and changes that put a domestic technology's ownership or actual control in foreign hands.

Registration takes place through the Ministry of Commerce's technology trade application on its unified business platform. Exporters must provide details including the exporter and recipient, destination country or region, technology, intended use and estimated export value.

The ministry also distinguishes between transferring technology and providing access to a service. Under its explanation of the proposed rules, deploying restricted AI technology locally overseas would fall within export management. Some arrangements, such as deployment in a company's own overseas cloud, could qualify for automatic licensing procedures.

Providing model access through an API, an app, a website or software as a service would fall outside the large model technology export category described in the explanation. Lightweight deployment on local devices is also listed outside that category. An API lets one computer program request a service from another, allowing customers to use a model without receiving its underlying files.

Open releases have their own treatment

China's announcement excludes technology already in the public domain through open source releases or academic papers. The ministry also describes automatic licensing and other simplified procedures for certain AI technology exports involving open releases, overseas research cooperation and related activities.

Publication and transfer therefore matter alongside technical capability. A company offering a hosted model, a company transferring restricted technology for overseas deployment and a developer distributing technology already in the public domain can face different treatment under the stated framework.

Moonshot's planned weights release makes those distinctions relevant to its international reach. The government has not issued a public classification of K3.1 Pro in these documents, and the final catalogue's implementation date has not been given.

The next dates bring the release schedule and policy process close together:

• July 16, 2026: Kimi K3 was released, followed by a planned weights release on July 27.
• October 16: China issued Announcement No. 48, opened consultation and began temporary export registration.
• October 23: Moonshot released K3.1 Pro.
• October 24: Moonshot outlined its reduction of offensive cyber capabilities.
• November 4: Moonshot plans to have published K3.1 Pro's weights.
• November 15: Public comments on the proposed export catalogue revisions close.

More capability at a lower access price

K3.1 Pro's broader launch helps explain why its cyber abilities matter beyond specialist security work. The model has 2.8 trillion total parameters, with 104 billion active parameters, placing it in the roughly 3 trillion parameter class described by Moonshot. Parameters are the numerical settings a model learns during training.

The model has a context window of one million tokens and accepts text and images. Tokens are pieces of information processed by the system; a larger context window lets it work with more material in a single task. Moonshot also offers K3.1 Pro Highspeed, which it says runs two to three times faster.

Standard API prices fell from $3 to $2 per million input tokens and from $15 to $10 per million output tokens, reductions of one third. Cached input, which reuses previously processed material, fell from $0.30 to $0.20 per million tokens. Highspeed pricing is $4 for input and $20 for output per million tokens.

Artificial Analysis's Intelligence Index placed K3.1 Pro fourth with 55 points, up 11 points from K3 and three behind Claude Opus 5.5 at 58. Moonshot's terminal coding comparison gave K3.1 Pro 65.7%, close to Opus 5.5's 66.4%. On scientific terminal work, however, Moonshot listed K3.1 Pro at 38.1, below GPT-6 Astra at 68.1 and Opus 5.5 at 63.3.

Moonshot also published different error figures for different tests. Its launch blog put the rate of fabricated or incorrect claims at 8.3%, down from K3's 23.4%; its API quickstart gave 6.85%, down from 23.35%, using a different set of conversations. Both documents describe specialised tests, while customers still need to check answers in their own work.

For developers and security teams, the immediate change is access to stronger coding and automation at lower token prices. For Moonshot, publishing the weights would move more decisions about deployment, modification and safeguards to the organisations downloading them.

Key Points

• Moonshot says removing cyber training material cut K3.1 Pro's internal exploit test score from 90.5% to 81.0%.
• The filtered model still scored well above Kimi K3's 33.3% on the same test.
• The internal benchmark is unpublished, and the new results have not been independently verified.
• Earlier UK and US testing found K3 could complete a simulated corporate network attack in one of 10 attempts.
• China proposes prohibiting AI malware technology exports and restricting AI vulnerability discovery technology exports.
• Temporary export registration began October 16. Public consultation closes November 15.
• Moonshot plans to publish K3.1 Pro's weights by November 4, giving outside developers greater control over how it is used.