Short answer: A little, and only on a test you cannot see. Moonshot says the released Kimi K3.1 Pro solves 81.0 percent of the tasks on xdev-bench-hard, its private hacking exam where the model must write a working exploit. A checkpoint from the same training run that kept the hacking material solves 90.5 percent. That is a 9.5-point cut. The downloadable weights are promised by 4 November 2026, and a file someone has already copied cannot be switched off later.
Hold this one picture: leaving eggs out of the batter is not the same as pulling eggs out of a baked cake. Moonshot left some eggs out. It did not, and could not, take the skill out of a finished model.
Everything below is checked against Moonshot’s own K3.1 Pro tech blog and the K3.1 Pro API quickstart, both read on 26 October 2026. No exploit was run and the benchmarks were not reproduced; every percentage here is Moonshot’s.
What Kimi K3.1 Pro Is, and What You Can Use Today
Kimi K3.1 Pro is Moonshot’s new top model, and the hacking result is one section of a much larger launch.
A model is a program that learned patterns from examples instead of following rules a person typed out. Moonshot calls K3.1 Pro “our most capable 3T-class open-weight model to date”, a post-trained version of Kimi K3 with a 1-million-token context window. “3T-class” means its learned numbers are on the order of three trillion. That is a size claim, not a safety score.
A token is the small chunk a model counts, often a word or part of a word. One million of them is enough for a long book or a large code repository in a single conversation.
You can use it today on Kimi.ai, the Kimi mobile apps, Kimi Work, Kimi Code and the Kimi API. A faster sibling, K3.1 Pro Highspeed, is listed at two to three times the speed. What you cannot do yet is download it. The blog says the full model weights “will be released by Nov 4, 2026”.
On the API, the model ids are kimi-k3.1-pro and kimi-k3.1-pro-highspeed. The quickstart says thinking mode (the model writes a private chain of steps before it answers) is always on, and you can only turn the effort down with reasoning_effort set to low, high or max. The model unlocks after a minimum top-up of one US dollar.
What a Weight Is, and Why a Skill Cannot Be Deleted From One
A weight is one learned number. The skill lives in the pattern of all of them, not in a folder named hacking.
A calculator stores a rule a person wrote: add these two digits. A model does not store the pages it read. Training is the long job of showing examples and nudging every number until the answers look right. Each nudge is tiny, and there are trillions of numbers.
When training stops, the examples can be thrown away and the numbers stay. Asking a new question is just running those numbers.
So “we deleted the hacking articles” is the wrong picture if you mean the finished file. By then the articles have already been stirred in. The only honest lever is earlier: do not stir that material in, or stir in less of it. That is the lever Moonshot says it pulled.
The Two Training Stages Moonshot Filtered
Moonshot says the hacking skill came from two ordinary training stages, not from a switch at the end.
Mid-training is a middle phase, after the model already knows basic language, where it reads a huge mixed pile of text. Moonshot says cyber content (material about breaking into software) was “embedded within the general mid-training corpus”.
RL, or reinforcement learning, is the stage where the model tries a task, gets a score, and is nudged toward the attempts that scored well. Cyber tasks were sitting in the RL task list next to ordinary coding tasks.
Moonshot calls this “a natural byproduct of training on broad data”. In its own early experiments, skipping the removal at either stage made the finished model’s cyber skill rise substantially. For the open-weight release, it says it removed cyber-related data from both stages and kept the general coding tasks, because a model that cannot code is not useful.
How the Kimi K3.1 Pro Hacking Test Works
xdev-bench-hard is Moonshot’s private exam. Each task comes with a hint, and nobody outside Moonshot has marked it.
Moonshot describes xdev-bench-hard as an in-house set of “expert-curated, source-code-based vulnerability discovery and exploitation tasks”. A vulnerability is a mistake in a program that lets someone make it do something the author did not intend.
Most tasks recreate recently disclosed bugs in real software with mitigations enabled. A mitigation is an extra safety feature meant to make a bug harder to use, so the easy version of the bug does not count. The named targets are the Linux kernel, Node.js, JavaScriptCore (the JavaScript engine in WebKit browsers), the Exim mail server and VirGL (graphics sharing for virtual machines).
Each task hands the agent three things: the vulnerable source code, a short bug hint, and the compiled binary. The agent must write an exploit, get arbitrary code execution inside a separate sandbox, and read back a secret string so an automatic checker can mark the attempt.
The hint matters. This is not “find a bug in a strange codebase with no clues.” The blog’s footnotes add that K3.1 Pro ran the exam inside Moonshot’s own KimiCode harness, while the two other open models it compares there, GLM-5.3 and DeepSeek-V4.1-Flash-1017, ran in the Claude Code harness. The task list is not public.
What Pass@3 Means for the 81 Percent
The model gets three tries, and a task counts as solved if any one of them works.
Pass@3 is a kinder rule than one shot. A student who fails twice and succeeds once is a pass. Moonshot also says there was no hard timeout and no cap on output tokens, and that it reports “pass@3 over a random subset of runs”.
So 81.0 does not mean the model breaks into 81 of every 100 machines on the first try, quickly, with no hint. It means that on this private set, with a hint, three attempts, no clock and no length limit, 81 percent of scored tasks eventually returned the secret.
| Build | What Moonshot says changed | xdev-bench-hard pass@3 |
|---|---|---|
| Checkpoint without the filters | Cyber text kept in mid-training, cyber tasks kept in RL | 90.5% |
| Kimi K3.1 Pro (release) | Cyber text and cyber RL tasks removed, general coding kept | 81.0% |
The gap is 9.5 points. On Moonshot’s telling it is real. It is also a gap inside a test the public cannot grade.
Why the Score Did Not Collapse
A model that is better at ordinary coding can work out steps it was never shown.
Moonshot says it plainly: K3.1 Pro still “improves substantially over its predecessor” on these tasks, because stronger general coding and long debugging “generalize to cyber tasks even after targeted data removal”.
Think of a locksmith banned from reading one chapter of the manual. If what they kept was how mechanisms move, they can still open a lot of those locks. Moonshot removed a chapter. It did not remove mechanisms, and it kept the coding tasks on purpose.
The blog puts a number on that coding skill. On Terminal-Bench 4.0, a test of coding agents doing realistic jobs in a terminal, K3.1 Pro scores 65.7 percent, against 66.4 percent for Claude Opus 5.5 and 58.2 percent for GPT-6 Astra. The footnotes say K3.1 Pro was run in the Claude Code harness, while the rival scores were taken from those labs’ posts or the public leaderboard. So the three numbers did not come from one shared run.
On Moonshot’s internal Kimi Code Bench 3.0 Long-horizon, the blog prints 61.2 percent for K3.1 Pro against 55.95 percent for K3. That is useful as a “coding got better” line, not as an outside grade.
A model that close to the coding frontier will keep wandering into security work, because exploit writing at this level is coding against a program that does not want to cooperate.
What Happens After the Weights Leave the Building
Anyone with the file can try to train the skill back, and Moonshot cannot push a refusal onto that copy.
Fine-tuning means taking a finished model and training it a little more on new examples. It is the obvious next experiment once the file is out. The tech blog does not say whether the cut survives fine-tuning, and that absence is the fact to hold on to.
Two sentences on the same page pull in opposite directions. First: “we aim not to release open weights that would extend the absolute frontier of cyber capability.” Second: “we intend to progressively raise the cyber capability available in open weights.”
Read together, this release is a pause, not a ceiling. Moonshot also argues the pause helps defenders, because a model that runs on your own hardware lets more teams audit code that never gets a proper security review. Real exploits do hide in old, unreviewed code, as the PHP2Shell bug that a WordPress update does not close shows. That argument can be true while the 9.5-point gap is still small. Both fit.
Moonshot adds that K3.1 Pro’s cyber skill “remains behind that of frontier proprietary models that have been publicly available for at least three months”. The text of the cyber section does not print those models’ scores on xdev-bench-hard. A sentence without a number is not a measurement.
The practical point is simple. An API copy can refuse a prompt tomorrow, because Moonshot still holds it. A weight file on your disk does not receive the next refusal.
Do Moonshot’s Own Numbers Agree With Each Other?
Not always. The two official pages already differ on a different score, so the cyber figures deserve the same care.
This check is not about the hacking test. It is about how tightly Moonshot’s own numbers match across its pages.
| Official page | K3 claim-level errors | K3.1 Pro claim-level errors | Answers with an error, vs K3 |
|---|---|---|---|
| Tech blog (Kimi Hallu Bench Hard) | 23.4% | 8.3% | 42.4% of K3’s rate |
| API quickstart (user-flagged conversations) | 23.35% | 6.85% | 46.4% of K3’s rate |
The blog names the test Kimi Hallu Bench Hard. The quickstart describes “de-identified conversations where users had flagged factual errors in earlier models’ responses” and does not name it, so the pages may be describing two versions of the eval. Either way, the published figures differ by more than rounding, and both pages warn the set is a stress test, not a picture of everyday error rates. The quickstart’s Terminal-Bench paragraph also still shows unfilled “[xx.x%]” placeholders, which says something about how fast these pages went up.
The cyber numbers have a harder problem. 90.5 and 81.0 appear in the same wording on both pages, but there is no public task list and no outside rerun. They are one lab’s before-and-after on one private exam, with a hint and three tries. A 33.3 percent score for K3 on this exam circulates in secondary write-ups. It does not appear on either official page, so it is left out here.
How to Try Kimi K3.1 Pro Before the Weights Arrive
The API is the only way to test it today, and it uses the OpenAI-compatible chat format.
This is the basic call from Moonshot’s quickstart, with reasoning_effort added and set to low for a quicker reply. It needs an API key in MOONSHOT_API_KEY and a topped-up account. It was not run for this article.
curl https://api.moonshot.ai/v1/chat/completions \
--header "Authorization: Bearer $MOONSHOT_API_KEY" \
--header "Content-Type: application/json" \
--data '{
"model": "kimi-k3.1-pro",
"reasoning_effort": "low",
"messages": [{"role": "user", "content": "Introduce Kimi K3.1 Pro in one sentence."}]
}'If you plan to run the file yourself later, do the size arithmetic now. Moonshot has not said what format the weights ship in. At one byte per weight, three trillion weights is roughly 3 TB of files; at two bytes it is roughly 6 TB. That is far beyond any single consumer GPU; for how memory limits play out at a much smaller size, see whether a 125B model runs on a 12GB GPU. A promised file is also not a download yet, which is the same lesson as Mistral Large 4’s still-pending open weights.
Before You Download the K3.1 Pro Weights
Do not download a promise, and do not treat 81 percent as a safety certificate.
- Wait for the actual file. “By Nov 4, 2026” is a sentence on a blog until the repository exists.
- If the host publishes a SHA-256 hash for each file, check it against what you received. A hash is a short fingerprint of a file, so a single changed bit shows up.
- Read the license before you run anything. A weight license can ban commercial use or further training, and the cyber section does not settle it.
- If you run agents, assume this model can still attempt exploit-shaped tasks. Give it the permissions you would give a new contractor, not root on your laptop.
- Do not expect a self-hosted copy to be safer than the API. The API can still refuse. Your file cannot.
- If you need a number you can defend, grade it on a test you can rerun. xdev-bench-hard is not that test today.
# after downloading, print a SHA-256 fingerprint for every weight file
sha256sum *.safetensors
# compare each line with the hash shown by the host; any mismatch means a different file
Common questions about Kimi K3.1 Pro’s hacking cut
Did Moonshot make Kimi K3.1 Pro worse at hacking?
On its own test, yes, by 9.5 points: 90.5 percent down to 81.0 percent at pass@3. That is the only before-and-after it published, and it is not an outside measurement.
Can I download Kimi K3.1 Pro today?
No. Moonshot says the full weights will be released by 4 November 2026. Kimi.ai, the apps, Kimi Work, Kimi Code and the API are what you can use now.
Does deleting training data delete the skill?
Not cleanly. Moonshot removed cyber text from mid-training and cyber tasks from reinforcement learning, and the released model still solved 81 percent of the exam. General coding stayed in, and Moonshot says that skill carries over.
Is 81 percent a pass on the first try?
No. Pass@3 means three attempts, and one success counts. There was no hard time limit and no output-token limit, and each task includes a short bug hint.
Will the cut survive if someone trains the model further?
Moonshot does not say. Further training on a copied file is possible in principle. Treat “unknown” as the current answer, not as a hidden yes.
Should defenders want this model?
Moonshot’s case is that a model you run yourself helps people audit old code. That can be true. It does not make 81 percent a small number, and it does not let Moonshot disable your copy later.