Filtered Kimi K3.1 Pro scores 81 versus 90.5 unfiltered – but well above predecessor's 33.3
The Chinese company Moonshot AI reported on October 24, 2026 that it has removed cyber-related data from the training of its new flagship model Kimi K3.1 Pro, thereby making it worse at offensive hacking. According to the company's own, independently unverified figures, the filtering cost around 9.5 percentage points on an internal exploit benchmark — while coding performance is largely preserved. On November 4, the weights are due to be released, and at that point the company's claim becomes testable by anyone.
What Moonshot removed
Moonshot says it has removed cyber-related data from the model's training corpus and from its reinforcement learning environments in order to limit the potential for misuse. The company states that general coding ability has been preserved, while the model's capacity for offensive cyber operations has been reduced (StratNews Global).
The company's own rationale, as quoted in the coverage: "We aim not to release open weights that would extend the absolute frontier of cyber capability." That is an unusual statement from a frontier lab: most labs handle cyber risk through safety filters at the API level, not by changing the training data itself. Moonshot has thus chosen to make its model measurably weaker in one area, rather than barricading it.
What it cost — according to Moonshot itself
On Moonshot's internal exploit benchmark, the filtered Kimi K3.1 Pro scored 81.0 percent. An unfiltered version of the same model, trained with the cyber data retained, scored 90.5. The filtering thus cost roughly nine and a half percentage points on offensive capability (Crypto Briefing).
The comparison with the previous generation is more striking: Kimi K3 scored only 33.3 percent on the same test. That means even the filtered version of the new model sits far above its predecessor's raw performance — the filter reduces a leap, it does not undo it.
Two caveats matter here. First, these are Moonshot's own figures, and the sources themselves note that they are not independently verified. No primary sources from the company — a model card or technical report — are yet available in the accessible documents. Second, the benchmark is internal: its design, difficulty, and how well it reflects real offensive capability are not documented. The 81.0 versus 90.5 figure is therefore a company accounting of a trade-off the company itself has defined.
What was preserved: almost everything else
Independent testing suggests the price was not paid in general capability. The day after the October 23 launch, the analyst firm Artificial Analysis placed Kimi K3.1 Pro fourth among 215 models globally on its Intelligence Index, three points behind the leader (Intelligent Living).
On Terminal-Bench 4.0, a terminal coding benchmark, Moonshot reports 65.7 percent — a level the company compares with Anthropic's Claude Opus 5.5. Independent measurement from Artificial Analysis lands at 67.2 percent. The figures are close but not identical, and they remain unreconciled in the coverage; either way, both point to coding ability not being where the trade was made. For comparison, the predecessor Kimi K3 scored around 13 percent on the same test according to the independent measurement.
Kimi K3.1 Pro is built on a mixture-of-experts architecture with a total of 2.8 trillion parameters, of which 104 billion are active per token, and a one-million-token context window. StratNews describes the model as Moonshot's most capable open-weights model in the "three-trillion-parameter class" — a framing consistent with 2.8 trillion, but one the sources do not explicitly reconcile.
When the weights are released by November 4, the model will, by this measurement, be the highest-scoring open-weights model in existence. It is precisely that combination that makes the story significant: a flagship-grade asset that anyone can download, run locally, and modify.
The industry and regulatory backdrop to the decision
The move comes in a climate where open weights are already contested. At the International AI Summit in Dublin, Guillaume Princen, Anthropic's head of international, told Bloomberg TV on October 14 — ten days before Moonshot's announcement, and in the general debate, not directed at the company: "We need to be really careful with open-source on safety." Pressed on whether all open models pose the same danger, he added: "I can't talk for open models. But by definition, there's more risk with them."
Moonshot's move can be read as an attempt to address exactly this argument: if the danger of open models is that capability spreads freely, then perhaps one can release weights that no longer contain the capability. At the same time, China is weighing draft export controls targeting AI-driven generation and mutation of malware, as well as restrictions on AI-assisted vulnerability discovery (StratNews Global). Moonshot is thus operating in a regulatory landscape where AI-assisted cyber capability is coming under state control — even as the company plans to share the weights freely.
The question November 4 must answer
The real test is not the announcement but the release. The filtering happened in the training data and learning environments. Once the weights are public, anyone can fine-tune the model on their own cyber data and try to rebuild what was removed. None of the available sources can say whether data filtering survives such modification — which is precisely what makes the November 4 release a real test, not just a launch.
Several things will then be checkable: whether the figures 81.0, 90.5, and 33.3 hold up; how the exploit benchmark is actually constructed and what it measures; and how the unfiltered versus the filtered model differ in practice. For now, the entire trade-off rests on Moonshot's own, unverified measurements and a benchmark whose design is undocumented. November 4 is the deadline at which independent verification can begin.