Before the version of Kimi K3.1 Pro that Moonshot AI shipped on October 23, there was a checkpoint trained on the same pipeline without its cyber data filtering. That checkpoint solved 90.5% of the problems on xdev-bench-hard, an exploit-development test. The released model solves 81.0%. Moonshot’s launch post says it “identified and removed cyber-related data from both training stages” ahead of the open-weight release, and that the removal “meaningfully reduces cyber capability.”
A 9.5-point drop is real, and Moonshot deserves credit for publishing the before and after instead of a single reassuring number. The same chart has a third bar, though. DeepSeek V4.1 Flash, an inexpensive open model anyone can already download, scores 85.7% on that test. That is higher than the scrubbed Kimi.
The week before, a threat researcher published a look inside a hacking campaign that broke into more than 100 company websites. The worker name in the attacker’s own control panels was claudecode_deepseek-v4.1-flash.
What Moonshot shipped
Kimi K3.1 Pro is a post-trained upgrade of Kimi K3. It keeps the same mixture-of-experts architecture: 2.8 trillion total parameters, 104 billion active, a 1 million token context window, and text plus image input. It is live now in the Kimi apps and on the Kimi API, with a Highspeed variant that Moonshot says runs two to three times faster. The weights “will be released by Nov 4,” according to the launch post, which does not say what license they will carry.
Pricing fell by a third on every rate. Artificial Analysis lists $2 per million input tokens, $10 per million output and $0.20 for cache hits, against $3, $15 and $0.30 for K3. The Highspeed tier is $4 and $20, per The Decoder’s pricing table.
The independent number is the one to anchor on. Artificial Analysis scores K3.1 Pro at 55 on its Intelligence Index, fourth overall, behind Claude Opus 5.5 at 58 and Claude Sonnet 5.5 and Meta’s Muse Wonder Full at 56. That is an 11-point jump over K3. Cost to run the index was $1.98 per task, roughly flat against K3, because the new model writes about 14% more output tokens (55K per task against 48K) and eats most of the price cut. Artificial Analysis says that once the weights are out, the gap between the best open-weight model and the best proprietary one narrows from 12 points to 3.
Moonshot’s own table, reproduced by The Decoder, is more aggressive, and every number in it was run at “max” reasoning effort. Terminal-Bench 4.0 comes in at 65.7%, against 66.4% for Opus 5.5 and 58.2% for GPT-6 Astra. K3 scored 13% on the same test. K3.1 Pro also leads its comparison set on SWE Marathon (51.7 against Opus 5.5 at 46.3), BrowseComp (92.1), and OfficeQA Pro v2 (64.4). It trails on GPQA Diamond, where GPT-6 Astra scores 96.1 to Kimi’s 94.2, and on GDPval-AA. As with every launch this autumn, a vendor table is a hypothesis about your workload, not a result, and the case for building your own evals still applies.
Hallucination is the other claim worth testing. On Moonshot’s internal stress test, per The Decoder, the share of false claims fell from 23.4% for K3 to 8.3%. GPT-6 Astra scores 5.5% on the same test. Moonshot calls it a stress test, not a general error rate.
The cyber number, read against Moonshot’s own chart
Here is the full exploit picture from the launch post, all on xdev-bench-hard at pass@3:
- K3.1 Pro checkpoint without risk reduction: 90.5%
- DeepSeek V4.1 Flash: 85.7%
- K3.1 Pro as released: 81.0%
- GLM 5.3: 57.1%
- Kimi K3: 33.3%
A proprietary OpenAI model, evaluated by a third party, is listed at the top of the chart with a perfect score. On the separate ExploitBench test, The Decoder’s table shows K3.1 Pro at 74.7 against 91.0 for Opus 5.5 and 100 for GPT-6 Astra. Moonshot’s own summary: “K3.1 Pro’s cyber capability remains behind that of frontier proprietary models.”
Read the way Moonshot frames it, this is responsible behavior. Open weights cannot be recalled once someone downloads them, so the lab trained out the part that would have pushed the open frontier forward on offense. The Next Web put the intent plainly: Moonshot removed the material “so it would not push the limits of what freely available models can do.”
Read against the rest of the chart, the claim is narrower than the headlines. Removing the cyber data kept Kimi from setting a new open-weight ceiling. It did nothing to the floor, because the floor already sits at 85.7% and has a model name attached. The scrub tells you that Kimi K3.1 Pro will not be the most capable freely available offensive model when its weights land. It does not tell you that offensive capability in open models went down. That level was set months ago by a cheaper model, and it was not set by Moonshot.
There is a second limit, and the launch post says nothing about it. Data removal shapes the weights Moonshot releases. Once those weights are public, anyone can fine-tune them, and the post does not describe how Moonshot would evaluate or respond to a derivative trained back toward offense. That is not a criticism unique to Moonshot. It is the structural fact of every open release, and it is why a capability ceiling is a more honest frame for a scrub than a safety guarantee.
What a $50 breach was built from
On October 19, Snorre Fagerland, principal threat researcher at NorForge, published an inside look at Cairn, an open-source agent platform where an operator sets a target and a goal and agents work toward it by posting findings to a shared board. Fagerland found the control panels by scanning the internet. Many had been left exposed with no authentication. Reuters reviewed the research before publication and identified victims including Deere, SharkNinja and Cummins.
According to The Next Web’s account, the main Chinese-language cluster ran more than 1,100 projects across 14 panels. It targeted online shops in the US, Canada, Japan and Australia, and its goal on each site was to run code and plant an uploader web shell, which points to persistent access to shop and payment systems. By Reuters’ count, the group’s agents had tried more than 1,200 sites. Fagerland estimated about $5,000 in tokens in total, or roughly $50 per successful break-in. NorForge’s own estimate is about $5 per task, failures included, with an average success rate “hovering around 10%.” Fagerland says the uncertainty on those figures is considerable, so read them as order of magnitude, not invoice.
Look at the model in that worker name. Per the NorForge report, the main worker was claudecode_deepseek-v4.1-flash, which NorForge reads as Anthropic’s Claude Code harness driving DeepSeek’s low-cost V4.1 Flash. A second cluster ran pi_openrouter_deepseek. NorForge says it did not have actual token-usage data, so the pairing is an inference from naming. Even so, the model at the center of the most widely reported AI hacking campaign of the month is the same one sitting at 85.7% on Moonshot’s chart, above the model Moonshot scrubbed.
The entry points matter as much as the model. The NorForge write-up lists the task goals as login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass, server-side template injection, SSRF and business logic flaws. One documented intrusion chained unauthorized write access to a memcached session store with unsafe PHP deserialization and a gadget chain in legacy Zend Framework components. The tooling included a proof of concept for a Magento CVE and a deprecated module that was meant to block executable uploads. In one case, the agents found no hole in a large company’s public application, so they spent hours on a linked control panel until it ran their commands.
None of this needs a frontier model. It needs patience at a price where patience is nearly free: 23 hours of trial and error on a successful target, run in parallel across hundreds of targets, for the price of a lunch per success. “It’s not script kiddie stuff,” Fagerland told Reuters. That is true of the output. The inputs were an open-source harness, a budget model, and a list of web flaw classes that have been in every security training course for a decade.
Two readings of one week
Put the two stories together and you get a mismatch between where the industry argues about AI cyber risk and where the damage is happening.
The argument is about the ceiling. OpenAI built its GPT-6 Astra rollout around the model’s Critical cyber rating. Anthropic split Mythos-class capability into an access regime with verification tiers. Google is shipping Gemini 4 Argon to vetted defenders first. Now Moonshot is scrubbing training data so its open release will not lead on offense. Every one of those decisions is about what the most capable model can do in the worst hands.
The damage this month came from the floor. A budget open model, a harness designed for something else (Cairn’s author wrote on X that harmful hacking “is not my intention”), and a target list full of unpatched Magento, legacy PHP and unauthenticated admin panels. According to The Next Web, in September Gambit Security found Cairn on an attacker’s server reportedly tied to the theft of at least 600,000 credit card records from 25 companies. The attackers also left their own panels open to the internet, and hundreds of credentials and API keys inside them, 11% of which a secrets scanner verified as live. This is not a sophisticated adversary. It is a cheap one, and cheap is what scales.
Neither reading cancels the other. Ceiling controls matter, because the next generation of the floor is this generation’s ceiling, and a 90.5% open model released without filtering would have moved the floor up for everyone. Moonshot made the right call. But a buyer or a defender who reads “hacking skills removed” as a reason to relax about open-weight models has the risk upside down.
What to do with Kimi K3.1 Pro, and with your web estate
For teams evaluating the model: K3.1 Pro is the strongest case yet for an open-weight model at near-frontier quality. It is 3 points off the top of the independent index at $2 and $10 per million tokens, with weights due in under two weeks. It is a candidate for workloads where the eventual ability to self-host matters, and for long-context office and research tasks where Moonshot’s table is strongest. Three cautions before you commit. First, every vendor number was produced at max effort, so meter cost per completed task at the effort level you will actually run. Second, the weights are a promise until November 4, and the license is unstated. Third, OpenRouter’s model page notes the model “is not currently available through EU in-region routing,” which rules that route out for some residency requirements today. Kimi Enterprise admins also need to switch it on, because per the launch post access “is off by default at launch.”
For teams defending websites, the lesson of the week has nothing to do with Kimi. The campaign that hit Deere and SharkNinja used none of the capability the frontier labs are rationing. It used the patience of an agent on top of flaws you can find and close without any AI at all:
- Inventory every internet-facing property, including vendor-run support sites and linked admin panels. Two of the named victims’ exposures were exactly that.
- Patch or retire legacy e-commerce and PHP stacks. Magento extensions and old Zend components were in the documented chains.
- Put authentication in front of every control panel and internal tool. The attackers’ own exposed panels are how they got caught, which tells you how common the mistake is.
- Watch for new files in web roots and upload directories. An uploader web shell is quiet; a file integrity check is not.
- Assume the attacker’s cost per attempt is close to zero and it can wait 23 hours, so throttling, lockouts and anomaly alerts on admin endpoints matter more than they did when every probe cost a human’s time.
The boundary controls we covered in September were written for agents you run. The same logic applies to agents someone else is running against you: the model’s skill is the part you cannot change, and the exposed surface is the part you can.
Moonshot removed 9.5 points of exploit skill from a model that has not shipped its weights yet. A hacker with a $50 budget per break-in did not need those points. The useful question about open-weight cyber risk is no longer how capable the next model is. It is how much of your estate a model that already exists could get through this weekend.