Moonshot AI Publicly Quantifies Attack-Mitigation Capability: Kimi K3.1 Pro Exploit Rate Falls to 81%, but Internal Tests Have Not Been Independently Evaluated

On November 4, 2026, Moonshot AI officially released the complete model weights for Kimi K3.1 Pro on Hugging Face. It is a native multimodal agent model with a mixture-of-experts (MoE) architecture, with 2.8 trillion total parameters, 104 billion activated per inference step, and support for context windows of up to 1 million tokens.

Moonshot AI also issued a safety statement: before releasing the weights, it had removed cyberattack-related data from the training corpus and reinforcement learning environment. The internal benchmark xdev-bench-hard shows that the untreated checkpoint had an exploit rate of 90.5%, while the released version of K3.1 Pro reduced this to 81.0%. According to Reuters, the results have not been independently evaluated by an outside institution.

What the Numbers Really Mean

The 9.5-percentage-point decline presents a more complex picture in absolute terms. On the same benchmark, DeepSeek-V4.1-Flash had a successful exploit rate of 85.7%, higher than Kimi K3.1 Pro's 81.0%. GLM-5.3 scored 57.1%, while the earlier Kimi K3 scored only 33.3%.

After safety processing, the model released by Moonshot AI still has a higher exploit capability than DeepSeek and GLM-5.3. Anthropic once described the open weights of GLM-5.3 as "posing a significant cyberattack risk." By the same standard, K3.1 Pro's position also carries risk.

Exploit capability is already widespread in current large models, and removing data at a single point cannot change the overall landscape. Moonshot AI's decision to proactively quantify this result reveals a shared industry dilemma.

Structural Contradictions of Open Weights

Safety interventions during training have implementation boundaries for open-weight models. After Moonshot AI provides the complete 1.56TB weight files, any organization or individual with computing resources can run, adjust, or fine-tune the model locally, and the terms of use no longer bind local deployment.

Moonshot AI's official blog acknowledges this limitation while noting that open weights allow safety researchers to directly examine internal model flaws, providing audit value for infrastructure that relies on legacy software.

xdev-bench-hard has not yet been released, so external researchers cannot reproduce the results from 90.5% to 81%. Fine-tuning may restore removed capabilities, and the Moonshot AI technical blog does not provide a quantitative assessment of this risk.

Divergence Between Two Paths

Anthropic's FlashProve mechanism uses cryptographic methods to provide regulators and users with verifiable proof that an inference request was completed by a specific model version rather than a substituted variant. This is the "auditable closed-source" path.

Moonshot AI chose to open all weights, remove dangerous data in advance, and quantify the effect of the intervention. The difference between the two paths lies in their answer to "who is responsible for safety": FlashProve keeps responsibility with the provider on an ongoing basis, while K3.1 Pro completes processing at the release point and then hands the model to the market.

Moonshot AI publicly states a principle of self-restraint: it will not release open weights that exceed the capability level of leading closed-source models from the previous three months.

Coding Capability: Public Benchmark Comparisons

K3.1 Pro's performance in the coding-agent field can be assessed against multiple public benchmarks. On Terminal-Bench 4.0, K3.1 Pro scored 65.7%, Claude Opus 5.5 scored 66.4%, and GPT-6 Astra scored 58.2%. On SWE-Marathon v1.1, K3.1 Pro led with 51.7%, ahead of Claude Opus 5.5's 46.3%. On DeepSWE v1.1, K3.1 Pro scored 75.5%, roughly on par with Claude Opus 5.5 (74.2%) and GPT-6 Astra (74.1%).

On coding tasks, the gap between top closed-source models has narrowed to single-digit percentages. K3.1 Pro enters this range as an open-weight model; for downstream developers, the significance lies in cost (API pricing is about two-thirds that of K3), data privacy, and deployment autonomy.

On Terminal-Bench Science 0.1, K3.1 Pro scored only 38.1%, while Claude Opus 5.5 reached 63.3% and GPT-6 Astra scored 68.1%. K3.1 Pro still trails top closed-source models in general scientific reasoning, and such capabilities are relevant to some advanced security analysis scenarios.

A Reference Point, Not an Endpoint

Moonshot AI's release marks the first time in the history of Chinese open-source models that a lab has publicly quantified the cost of "safety self-discipline" in concrete numbers. Previously, similar practices were mostly seen in red-team reports from Western labs.

The test tools are not public, external reproduction paths are missing, and follow-up control of open weights remains unresolved; these are real limitations. The transfer distance between general coding capability and exploit capability is shorter than benchmarks suggest. Removing specialized data can reduce ready-made attack capability, but it cannot eliminate the possibility of re-transfer from general reasoning to targeted dangerous capabilities.

Technically, Moonshot AI chose the most transparent approach, but transparency is not equivalent to safety. External safety researchers need to use equally rigorous tools to conduct independent capability assessments of the 1.56TB weight files and systematically test their attack potential.