Moonshot Makes Its New AI Worse at Hacking, on Purpose

Moonshot AI has made its newest model worse at hacking, and it says that was the point. The Beijing startup announced the curbs on Saturday as it introduced Kimi K3.1 Pro, which it calls its most capable open-weight model yet.

The company removed cyber-related data from the training corpus and from the reinforcement-learning environments used to build the model. It kept the model's general coding skills. The aim, Moonshot said, is not to put out open weights that push hacking ability further than it already goes.

“We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said.

Open weights are the files that let outside developers run and change a model on their own systems. Moonshot plans to publish Kimi K3.1 Pro's weights by November 4. Once those files are out, they cannot be taken back. A developer that hosts a model behind its own service can watch how it is used and change its safeguards. A developer that gives the weights away cannot.

That is the trade at the heart of the announcement. Moonshot argues that open weights help defenders, because more organizations can inspect and secure their own software, including older systems that get little attention. The same openness means the model can be picked up by anyone, including people who want it for attacks.

The numbers show how much the cut actually did. On Moonshot's internal test, which asks a model to find and exploit software flaws in a controlled setting, the released model scored 81.0%. A version built without the cyber-data removal scored 90.5%. The previous model, Kimi K3, scored 33.3% on the same test.

So the released model is still far more capable at exploitation than its predecessor. It is simply less capable than it would have been. Moonshot said it still sits behind frontier proprietary models that have been publicly available for at least three months. The test results have not been independently verified.

On coding, the company says little was lost. Kimi K3.1 Pro scored 65.7% on Terminal-Bench 4.0, a coding benchmark, against 66.4% for Anthropic's Claude Opus 5.5, according to Moonshot's own figures. The model has a 1-million-token context window, so it can take in very large documents or codebases in one pass. Moonshot also released a faster version, K3.1 Pro Highspeed, which it says runs at two to three times the speed of the standard model.

The announcement lands in a week when governments have been moving on the same problem from the other side. China proposed export controls last week that would ban exports of AI-driven malware-generation technology and restrict AI-assisted vulnerability-discovery tools. The draft measures, which are open for public comment, cite the risk to critical infrastructure, defense-industrial systems and core government systems.

Moonshot's move does not settle the argument about open models. It makes the argument concrete. A lab can now say, in public, that it turned a dial down before release, and publish the size of the turn: nine and a half points on its own test. What it cannot say is that the dial stays down once the weights are out. Anyone with the files can train the missing skills back in. That is why the November 4 date matters as much as the announcement. It is the day the model stops being Moonshot's to control.