An open-weight model that deliberately dulls its own attack capability by nearly ten percentage points before shipping. TechTimes' framing: no open-weight frontier lab has publicly reported doing this before.
On October 23, Moonshot AI released Kimi K3.1 Pro, and the official blog spent an entire section on cybersecurity. In that section the company disclosed a number it did not have to disclose: on the same training pipeline with no additional controls, the solve rate on the in-house vulnerability-exploitation benchmark xdev-bench-hard is 90.5%. The version actually being shipped reaches 81.0%. The 9.5 percentage points in between were given up on purpose.
Full weights are promised by November 4 (official blog). Until those weights actually land, this is a self-reported promise rather than an externally verifiable fact.
Where the knife went
By the blog's own account, the intervention happened at two stages of post-training. Cyber-related content was embedded in the general mid-training corpus — train on broad data and vulnerability-research capability comes along for the ride — and cyber-related tasks were present in the RL environment mix. Moonshot's approach: for the open-weight release, remove cyber-related data from both stages, while keeping general-purpose coding tasks so the model does not end up a safety model that can do nothing.
xdev-bench-hard is an in-house benchmark of expert-curated, source-code-based vulnerability discovery and exploitation tasks. Most tasks faithfully reproduce recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, JavaScriptCore, Exim, and VirGL, with mitigations enabled. Each task gives the agent the vulnerable source code, a short bug hint, and the corresponding binary; the agent must develop an exploit, achieve arbitrary code execution in a separate sandbox, and retrieve a secret string for automated verification. Moonshot reports pass@3 over a random subset of runs, with no hard timeouts and no output token limits.
The comparison table shows the scale of the trimming: GPT-5.6 Sol (third-party evaluation) scores 100, Moonshot's own model without cyber risk-reduction scores 90.5, DeepSeek-V4.1-Flash 85.7, the trimmed K3.1 Pro 81.0, GLM-5.3 57.1, and the previous-generation K3 just 33.3. The interesting part is that K3.1 Pro is substantially stronger than K3 on general work — it takes 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra at 58.2% — yet on this one benchmark it deliberately lands below DeepSeek V4.1-Flash.
Three things left unresolved
First, the benchmark used to verify the claim is not public. xdev-bench-hard has not been released, so outside researchers cannot reproduce the with-removal versus without-removal comparison. Implicator cites another analysis site, Extrapolator: external adversarial testing will be required before the safety posture can be assessed, and the boundary of what counts as "cyber-related" content is fuzzy by definition, making the mitigation a filtering heuristic rather than a principled capability boundary (Implicator).
Second, nobody has said whether fine-tuning can restore what was cut. Open weights, once downloaded, cannot be recalled, and standard fine-tuning on a released open-weight checkpoint can in principle partially recover suppressed capabilities. Whether this measure holds is a research question only answerable after November 4, by people with the weights in hand.
Third, two official documents give two hallucination rates. The blog says K3.1 Pro's claim-level hallucination rate on the internal Kimi Hallu Bench Hard fell from 23.4% for K3 to 8.3%. The API quickstart says 23.35% to 6.85%. The two describe different test sets and neither references the other.
A contradictory but honest sentence
The most quotable line in the blog is that Moonshot aims not to release open weights that would extend the absolute frontier of cyber capability, while also stating that it intends to progressively raise the cyber capability available in open weights. One clause sets a limit, the other lifts it. Together they add up to a coherent strategy: an open model does not chase being the strongest, it chases being widely auditable.
Artificial Analysis's third-party measurements add some cold water: K3.1 Pro ranks fourth of 215 models on its Intelligence Index, and costs $2.11 per task, against $0.72 for GPT-6.1 Sol at the same $2-per-million-input, $10-per-million-output pricing. Output speed is 57.5 tokens per second, 141st of 186 models (TechTimes). The gap between self-reported tables and outside measurement is not narrowing.
The real story is not the scoreboard but the ordering: build the capability first, then decide how much to ship. Models used to chase benchmarks; now they chase a new constraint — how much am I allowed to release. When the weights land on November 4, the first thing security researchers will do is try to fine-tune those 9.5 points back. That is the real exam for this promise.