Why Moonshot Deliberately Weakened Its New Kimi AI Model's Hacking Skills

Moonshot AI, the Beijing-based startup behind the Kimi chatbot, unveiled Kimi K3.1 Pro on Saturday, October 24, 2026, describing it as its most capable open-weight model in the 3-trillion-parameter class. Alongside the launch, the company said it had intentionally scaled back the model's ability to help with hacking tasks, a rare public move by an AI developer to limit a model's own capabilities.

What Moonshot removed

According to Moonshot, the company stripped cyber-related data from both the training corpus and the reinforcement-learning environments used to build K3.1 Pro, while keeping the model's general coding skills intact. The company stated its goal as: "We aim not to release open weights that would extend the absolute frontier of cyber capability."

The trade-off is measurable, by Moonshot's own account. On an internal benchmark that tests a model's ability to find and exploit software vulnerabilities in a controlled setting, K3.1 Pro scored 81.0%, versus 90.5% for a comparable version of the model built without the cyber-data filtering. On a separate industry benchmark, Moonshot's filtered model still scored well above its predecessor, Kimi K3, on cyber-related tasks.

Independent testing tells a more mixed story

Outside evaluators have since produced their own numbers. Artificial Analysis's Cyber Index put K3.1 Pro's overall score at 64%, ahead of DeepSeek's V4.1 Flash model at 57% but behind the closed model GPT-6 Sol at 69%. That represents a 23-point jump over the original Kimi K3's score of 41% on the same index. The evaluators also noted K3.1 Pro produced no safety refusals during testing, unlike some competing public APIs that declined certain security-related prompts.

Analysis site Implicator.ai raised questions about how much the cyber-data removal can actually be verified. It noted Moonshot's core evidence comes from an unpublished internal test, and that the boundary of what counts as "cyber-related" training data is inherently fuzzy. The site also pointed out that DeepSeek's V4.1-Flash scored higher than K3.1 Pro (85.7% versus 81.0%) on the same internal benchmark Moonshot used to argue its filtering was effective, complicating the comparison. It added that Moonshot's release materials did not address whether the removed capability could later be restored through fine-tuning by outside developers once the open weights are published.

Why this is happening now

The announcement lands against a backdrop of rising official concern about AI-assisted cyberattacks. China's commerce and science ministries proposed export-control revisions on October 16, 2026, covering 23 AI-related technologies, that would prohibit exporting AI systems able to autonomously generate or modify malicious code, citing national security and the goal of keeping sensitive AI capabilities under human control. A separate, less strict category would restrict (rather than ban) AI tools capable of autonomously building working exploits for known flaws or discovering multiple undisclosed high-severity vulnerabilities in major software projects. Public comment on the draft runs through November 15, 2026.

Moonshot's self-imposed cyber limits can be read as a response to that regulatory direction, though the company has not explicitly linked the two. Moonshot plans to publish K3.1 Pro's open weights — the files that let outside developers run and modify the model on their own systems — by November 4, 2026.

Moonshot's bigger pattern: open weights after its own "DeepSeek moment"

K3.1 Pro follows Kimi K2, the trillion-parameter open-weight model Moonshot released on July 11, 2025, which was widely described as an "open-weight DeepSeek moment" — a reference to the shock earlier in 2025 when DeepSeek's R1 model showed Chinese labs could match frontier Western AI performance. Commentary site Interconnects.ai argued that Kimi K2 showed multiple Chinese organizations, not just DeepSeek, were now reaching near-frontier capability with efficient, openly released models.

Moonshot has argued that releasing model weights openly, even with reduced cyber capability, carries its own security benefit: organizations can inspect and test the software themselves rather than relying solely on a vendor's hosted service. That argument sits alongside the acknowledged trade-off that open weights, once published, cannot be recalled or further restricted by Moonshot after the fact.

Key figures at a glance