Friday, Nov 13 | --:--
Times of AI

Regions

China Europe India Japan Taiwan United Kingdom United States

Platforms

Alibaba Qwen Amazon Anthropic DeepMind Google Groq Meta Microsoft MiniMax Mistral Moonshot AI NVIDIA OpenAI PrismML Replit Thinking Machines xAI

Sections

Business Engineering Enterprise Frontier Labs Hardware Industry Infrastructure Models Policy Products Research Safety Security Work All articles → Subscribe by email
Back to home
Models Open Weights China Moonshot AI

Moonshot Publishes Kimi K3.1 Pro Open Weights, a 2.8-Trillion-Parameter Model With Cyber Training Data Removed

Updated November 5: Moonshot has published the Kimi K3.1 Pro weights on Hugging Face under its own Kimi K3.1 Pro License, meeting its 'by Nov 4' promise. The model card lists 2.8 trillion total parameters with 104 billion active, a 1-million-token context and MXFP4 weights, and repeats the 81.0% xdev-bench-hard score for the cyber-trimmed release. Artificial Analysis had ranked the API model fourth on its Intelligence Index; benchmark figures are Moonshot's own.

Times of AI Desk 8 min read Beijing View as Markdown
Faceted crystal brain on a stone pedestal with tweezers lifting out dark shards into a dish, next to a closed, unmarked wooden crate.

Updated November 5, 2026: Moonshot has released the Kimi K3.1 Pro weights. Earlier updates and the original reporting below are unchanged.

November 5: The weights are out#

Moonshot's Hugging Face repository moonshotai/Kimi-K3.1-Pro now hosts the model, as TechNode reported on November 5. The model card describes a mixture-of-experts model with 2.8 trillion total parameters and 104 billion activated, 896 experts with 16 selected per token, a context length of 1,048,576 tokens and a 401-million-parameter vision encoder. The weights ship in MXFP4 with MXFP8 activations, trained with quantization in mind, and Moonshot recommends vLLM, SGLang or TokenSpeed to run them. TechNode said Huawei announced inference support on its Ascend hardware.

The release is under the Kimi K3.1 Pro License, a custom licence rather than a standard open-source one. The card's benchmark table repeats Moonshot's earlier figures, including 65.7% on Terminal-Bench 4.0 and 81.0% on its internal xdev-bench-hard exploit test, the score it gave for the cyber-trimmed open-weight version.

Limits of the November 5 update#

  • We have not read the licence terms in full, so we do not describe its commercial conditions.
  • The model card's benchmarks are Moonshot's own; no independent evaluation of the downloadable weights has been published yet.
  • Hugging Face shows the repository was created on November 2; we could not confirm the exact time the files became public.

Updated October 26, 2026: Added Moonshot's apology and quota reset for subscribers, independent rankings from Artificial Analysis and Arena, and unverified reports of a creator brief. The original reporting below is unchanged.

October 26: Quota reset, outside rankings and an unverified brief#

Moonshot apologised on Sunday, October 25 for "the rate limits and unnecessary quota consumption on the K3.1 Pro subscription plan," saying: "These were our issues, and we should have fixed them sooner." It said every subscriber on every plan gets a one-time reset restoring 25% of their monthly quota, which it described as one week of usage. Moonshot also said it adjusted the plan's parameters and is cutting unnecessary subagent calls and output length.

Artificial Analysis, an independent benchmarking firm, said on October 23 that K3.1 Pro scores 55 on its Intelligence Index, fourth behind Claude Opus 5.5, Claude Sonnet 5.5 and Muse Wonder Full. It said K3.1 Pro will become the highest-scoring open-weights model once its weights are released. Artificial Analysis measured 67% on Terminal-Bench 4.0, which it called "the highest score of any model" on that test; Moonshot's own figure, reported below, is 65.7%.

On its Cyber Index, which measures agentic cyber-defence tasks, Artificial Analysis scored K3.1 Pro at 64%, the top openly available model and behind only OpenAI's trusted-access GPT-6 Sol (Daybreak Blue) at 69%. It said the index tests models mainly through public APIs, that some proprietary models lose points to safety refusals, and that "Kimi K3.1 Pro encounters no safety refusals."

Arena said K3.1 Pro entered its Agent Arena at #11 across more than 4,000 user sessions, which would make it the top open model there, and placed it #8 in Code Arena: WebDev.

Separately, an X user posted screenshots of what he described as instructions for a Kimi promotional campaign, including the line "Please DO NOT put on the paid partnership label," VentureBeat and Pekingnology reported. Both outlets say the document has not been independently authenticated, and VentureBeat says it is unclear whether it came from Moonshot, an outside agency or another party, or whether anyone posted under those terms. VentureBeat found no confirmed company response as of October 25.

As of the morning of October 26 (UTC), Moonshot's Hugging Face page listed no K3.1 repository.

Limits of the October 26 update#

  • Artificial Analysis's post says fourth; its leaderboard page listed the model fifth when checked on October 26.
  • Artificial Analysis tested the API model; we do not know whether it matches the open-weight version Moonshot says will have cyber training data removed.
  • The rankings are snapshots from each evaluator's own tests and can change.
  • We have not seen the creator brief; we do not name the X user and do not treat the screenshots as evidence of a Moonshot campaign.
  • Moonshot has not said how many subscribers hit the limits.
  • VentureBeat says the weights are due "on November 4"; Moonshot's own wording is "by Nov 4."

Moonshot AI is making an explicit trade with Kimi K3.1 Pro: release a stronger open-weight model, but deliberately hold back its hacking ability first, and publish the before-and-after numbers. Publishing those numbers makes the trade concrete, though every figure in it comes from Moonshot's own tests. On Friday, October 23, the Chinese lab released Kimi K3.1 Pro in its apps and API and said "the full model weights will be released by Nov 4."

What Moonshot released#

Moonshot describes K3.1 Pro as "a post-trained version of Kimi K3, with substantially larger post-training compute," with a 1-million-token context window. The Next Web reported that K3 has nearly 3 trillion parameters. We covered K3's open release in July.

The company also released K3.1 Pro Highspeed, which it says runs two to three times faster. It says K3.1 Pro is rolling out across the Kimi apps, Kimi Work, Kimi Code and its API, and that Kimi Enterprise administrators must turn it on for their organizations because access is off by default at launch.

On Terminal-Bench 4.0, a coding-agent test, Moonshot says K3.1 Pro scored 65.7%, "ahead of GPT-6 Astra (58.2%) and narrowly behind Claude Opus 5.5 (66.4%)." Moonshot also says its claim-level hallucination rate on an internal stress test fell from 23.4% for K3 to 8.3%, and it cautions that those rates "do not represent overall error rates in daily use."

How Moonshot says it limited cyber capability#

Moonshot says it saw vulnerability-research performance rise steadily as post-training scaled, and traced it to cyber-related content in its general mid-training data and cyber tasks in its reinforcement-learning environments. "For the open-weight release of K3.1 Pro, we identified and removed cyber-related data from both training stages, while retaining the general-purpose coding tasks needed for model usefulness," the company wrote.

It then tested the model on xdev-bench-hard, its in-house set of exploit tasks based mostly on recently disclosed vulnerabilities in software such as the Linux kernel and Node.js. Moonshot reports these pass@3 results:

  • Checkpoint without the cuts: 90.5%.
  • Released K3.1 Pro: 81.0%.
  • Kimi K3: 33.3%.
  • DeepSeek V4.1-Flash: 85.7%, by Moonshot's count.

Moonshot's chart also lists GPT-5.6 Sol, labeled as a third-party evaluation, solving all of the problems. The company says K3.1 Pro's cyber capability "remains behind that of frontier proprietary models that have been publicly available for at least three months."

Why the release policy matters#

Moonshot frames two rules for its open-weight releases. "First, we aim not to release open weights that would extend the absolute frontier of cyber capability," it wrote. "Second, we intend to progressively raise the cyber capability available in open weights." It argues that open models let more teams audit their own code, including legacy systems.

The Next Web noted that open models cannot be recalled once downloaded, and that safety researchers have warned their safeguards lag behind those of closed models. It also reported that in July the White House accused Moonshot of using banned Nvidia chips and copying an Anthropic model to build K3, without publishing evidence. Separately, OpenAI said in September that it had attributed a reasoning-extraction cluster to Moonshot.

Limits#

  • Every benchmark number here is self-reported by Moonshot. Several, including xdev-bench-hard and the hallucination test, are internal benchmarks that outsiders cannot run.
  • The released model's 81.0% is still far above K3's 33.3% on the same test, so data removal reduced cyber skill relative to Moonshot's own uncut checkpoint, not relative to the previous model.
  • The weights are not out yet. We could not check the model card, license or any independent evaluation, and the "by Nov 4" date is a promise.

Sources#

Prior Coverage

Earlier Times of AI reporting on this thread.

Related Coverage

Scroll to continue reading