Moonshot says cyber-data filtering cut Kimi K3.1 Pro exploit pass@3 to 81%

• Cyber-data filtering cut internal exploit-task pass@3 from 90.5% to 81.0%, according to Moonshot's comparison table.
• Defensive performance still leads publicly accessible models: Artificial Analysis scored K3.1 Pro at 64%, up 23 points from K3.
• Coding remained competitive: rohanpaul_ai's launch summary reports 65.7% on Terminal-Bench 4.0, 0.7 points behind Opus 5.5.
• Full weights are promised by November 4, according to the release timetable, while hosted access is already live.

Moonshot let exploit agents run without hard timeouts or output-token limits. The filtered model also produced zero safety refusals in Artificial Analysis's defensive evaluation.

Moonshot says vulnerability-research performance kept climbing as it scaled post-training. It traced cyber capability to two training stages and filtered both for the planned weight release:

• Mid-training: cyber-related content embedded in the general training corpus.
• Reinforcement learning: cyber-related tasks in the environment mix.

General-purpose coding tasks were retained.

Under its open-weight principles, Moonshot plans to keep released offensive capability below what its own pipeline can produce and below the proprietary frontier, while progressively raising capability available in open weights.

Most tasks reproduce recently disclosed vulnerabilities with mitigations enabled, according to Moonshot's evaluation protocol. Targets include the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL.

• Inputs: vulnerable source code, a short bug hint and the corresponding binary.
• Success condition: achieve arbitrary code execution in a separate sandbox and retrieve a secret verification string.
• Metric: pass@3, whether at least one of three attempts succeeds, reported over a random subset of runs.

The 9.5-point cut still leaves a formidable exploit agent: filtered K3.1 Pro beats K3's 33.3% by 47.7 points on this benchmark. Cross-vendor rows compare different model-harness pairs.

The Artificial Analysis Cyber Index covers vulnerability discovery, reproduction, validation and patching. It excludes weaponization and averages three evaluations, on which K3.1 Pro scored:

• CWE-Bench-AA: 61%.
• DeepsecBench-AA: 37%.
• CyberGym-E2E-AA: 95%, the highest score Artificial Analysis had tested.

Its overall 64% placed Kimi 7 points above DeepSeek V4.1 Flash 1017 and 5 points behind trusted-access GPT-6 Sol (Daybreak Blue, max).

Artificial Analysis primarily tests capabilities exposed through APIs, where some proprietary models lose points to safety refusals. It reported a 32-point gap between the public and trusted-access versions of GPT-6 Sol.

Removing cyber data could also weaken ordinary coding and defensive security, Lentils80 argued.

On Moonshot's internal long-horizon coding benchmark, K3.1 Pro scored 61.2%, up from 55.95% for K3. That published coding comparison is against the predecessor, rather than the unfiltered checkpoint used in the cyber ablation, so it does not isolate filtering's effect on coding.

K3.1 Pro consumed about twice as many input tokens as K3 across Artificial Analysis's cyber tests:

• Token prices per million input/output tokens: $3/$15 for K3 → $2/$10 for K3.1 Pro, about 33% lower.
• Cost per task: $2.45 → $2.81, about 15% higher.

For comparison, the evaluator measured $0.42 per task for DeepSeek V4.1 Flash 1017 and $1.77 for trusted-access GPT-6 Sol.

Moonshot followed its “PLAY BEYOND” teaser with a rollout across Kimi.com, mobile apps, Kimi Work, Kimi Code and the API. Full weights are promised by November 4, 2026, rather than being available at launch.

The company lists a 1-million-token context window and describes Highspeed as delivering 2–3× faster output generation. Enterprise access is off by default until an administrator enables it.

Venice also announced hosted Pro and Highspeed access, including anonymous use and a 20% API discount through October 31.

Artificial Analysis was still collecting AA-3D preference votes at launch and said early signs suggested a lower ranking than K3.1 Pro's coding and knowledge-work results.

Models reconstruct CAD objects from multiview renders in Moonshot's BenchCAD evaluation, where K3.1 Pro scored 92.7% with tools. AA-3D judges interactive scenes through preference votes, a different output from geometric reconstruction.