Why Moonshot Made Kimi Less Capable at Hacking

Capability filtering ahead of the planned open weight release

BunCosmos Research Lab | Analysis | 26 October 2026

AI companies normally compete by making their newest models better. Moonshot AI has done something more unusual: while building Kimi K3.1 Pro, it says the model became much better at finding and exploiting software vulnerabilities, so the company deliberately reduced that capability ahead of the planned release of the model weights. The decision opens a larger question for the open-AI era: what should developers remove before a powerful model can no longer be recalled?

The story in four numbers

Kimi was becoming better at hacking almost by accident

Kimi K3.1 Pro is the first model in Moonshot's new K3.1 series. It is a post-trained version of Kimi K3, with a one-million-token context window and much more reinforcement-learning training.

Moonshot says it improved considerably in coding, research, finance, tool use and other long tasks. It is already available through Kimi's apps, Kimi Work, Kimi Code and its API. A faster Highspeed version is also available.

But during development, Moonshot noticed something else. As it increased the amount of training, Kimi's ability to discover software vulnerabilities kept rising.

The company investigated where this capability was coming from. It found cyber-related material inside two important parts of training. Some was mixed into the large collection of general data used during what Moonshot calls mid-training. More cyber tasks were present inside the environments used for reinforcement learning, where the model learns by attempting tasks and receiving feedback about how well it performed.

This was not necessarily because Moonshot had decided to create a hacking model. Cybersecurity knowledge naturally overlaps with programming knowledge. A model that becomes very good at understanding software also becomes better at understanding how software breaks.

A model that can debug difficult code may also be able to discover the flaw that an attacker could exploit. This is what makes cybersecurity such a difficult AI-safety problem: the same intelligence can be useful to both sides.

A security engineer might ask an AI: 'Can you find the weakness in my company's software before an attacker does?' An attacker may ask essentially the same technical question for a completely different reason. The capability itself is dual-use.

Moonshot tried removing the dangerous part without damaging normal coding

Moonshot then performed an interesting experiment. It removed cyber-related data from both of those training stages while keeping general programming tasks.

The aim was not to make Kimi incapable of understanding computers. That would destroy much of the value of the model. The aim was narrower: preserve strong general coding ability while reducing the model's ability to perform advanced offensive cybersecurity work.

Moonshot tested the difference using an internal benchmark called xdev-bench-hard. This test is much more serious than simply asking a chatbot to explain what a computer virus is.

The tasks reproduce recently disclosed vulnerabilities in real software, including systems such as the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL. The model receives vulnerable source code, a small hint about the bug and the relevant software. It must then develop an exploit inside a controlled environment, achieve code execution in another sandbox and retrieve a hidden string that proves the exploit worked. Moonshot reports pass@3, measuring success across three attempts, with no hard timeouts or output-token limits.

A Kimi checkpoint trained without Moonshot's cyber restrictions solved 90.5% of the benchmark problems. The Kimi K3.1 Pro that Moonshot plans to release scored 81.0%. The earlier Kimi K3 scored only 33.3% on Moonshot's comparison.

So the safety intervention appears to have reduced cyber performance substantially compared with what Moonshot's new training pipeline was capable of producing. But it is equally important to notice something else: Kimi K3.1 Pro is still much more capable at these tasks than Kimi K3. Moonshot did not remove offensive cyber ability. It reduced how far that ability advanced.

What the 81 Percent Result Means

It would be wrong to read the result as: 'Kimi can hack 81% of computers.' That is not what the benchmark measures.

It is a controlled test using selected vulnerabilities, source code, hints, sandboxes and specific success conditions. Real networks contain different software, security tools, access controls, human defenders and many other complications.

The result tells us that Kimi was highly capable in this particular experimental setting. It does not tell us that the same success rate would occur against real organisations.

There is another limitation: xdev-bench-hard belongs to Moonshot. Reuters noted that the 90.5% and 81% results have not been independently verified. Moonshot has therefore provided useful evidence, but it remains company-produced evidence. Independent testing will become particularly important after the weights are released.

Why open weights change everything

The reason Moonshot's decision matters is not simply that Kimi is powerful. It is that Moonshot intends to release the model weights.

The weights are the huge collection of numbers created during training that contain the model's learned patterns and capabilities. When people use a closed model through a company's website, the company keeps those weights. When weights are released, other people can download them and operate the AI independently.

There are major benefits. A hospital, university or company could run an AI on its own infrastructure without sending private information to the original developer. Researchers can study models more deeply. Developers can adapt them to languages, industries and specialised tasks. Smaller organisations can build technology without depending permanently on a handful of large AI companies.

But the developer loses control too. Britain's AI Security Institute describes this difference clearly. Once model weights are released, copies can be downloaded, redistributed and operated privately. The original developer cannot reliably monitor their use, withdraw every copy or automatically update everybody's safeguards.

That makes a dangerous capability inside an open model fundamentally different from the same capability behind a controlled API. Once the weights leave the building, there may be no practical 'undo' button.

Moonshot summarized its own position in unusually clear terms: it does not want its open-weight releases to extend the absolute frontier of offensive cyber capability. In other words: the company says it knows how to make this model better at cyberattacks, but is deliberately choosing not to release the strongest version it can make.

“Once the weights leave the building, there may be no practical undo button.”

Why Refusing Dangerous Requests Is Not Enough

A company could train a model to answer: 'I cannot help you hack that system.' But that type of behavioural safety layer is much harder to rely on when people possess the model weights themselves.

Research has repeatedly shown that safety behaviour in open models can sometimes be weakened or removed through additional fine-tuning. The UK AI Security Institute similarly warns that refusal training is often reversible once someone controls the weights.

Moonshot took a different approach. Instead of only teaching Kimi not to use certain knowledge, it tried to reduce how much specialised cyber capability the model learned during training in the first place.

Imagine two students. The first student has been taught everything about an extremely dangerous technique but is instructed: 'Never explain this.' The second student was never given some of the specialised training required to master the technique. Removing the first student's rule might reveal everything immediately. Teaching the second student the missing knowledge may require considerably more work.

AI models are obviously much more complicated than students, but the analogy captures the difference between behavioural restriction and capability reduction.

There is some scientific evidence that filtering dangerous information earlier in training can be harder to reverse than simply adding refusals afterward. A 2026 ICLR study called Deep Ignorance found that models trained without certain dangerous biological information were much more resistant to attempts to restore that capability through later fine-tuning than models protected only with post-training safeguards.

But there is a large warning attached to that result. That research involved smaller experimental models and biological information. It does not prove that Moonshot's approach will remain robust for Kimi K3.1 Pro.

Whether the Hacking Capability Can Be Restored

At the moment, we do not know. This may become one of the most important questions once the weights are released; Moonshot has announced a November 4 deadline.

Once researchers receive Kimi's weights, they can investigate whether additional cyber data and reinforcement learning restore much of the ability Moonshot deliberately removed.

There are reasons to take that possibility seriously. Research on open-weight AI has shown that many safety protections can be weakened through additional fine-tuning, and protecting an openly modifiable model against determined modification remains an unsolved problem.

But it would be premature to say that Kimi's lost capability can simply be restored. Moonshot removed training material rather than merely placing a refusal rule on top of the finished model. Depending on what knowledge remains internally and how much general coding ability transfers into cybersecurity, rebuilding the missing capability could be easy, difficult or somewhere in between. We need experiments rather than assumptions.

There is another complication. Even a model that was never trained on some specialised knowledge may sometimes acquire that information later through tools. The Deep Ignorance researchers found that filtered models could still use dangerous information when it was supplied through external context, such as search systems.

This illustrates why AI safety increasingly uses the idea of defence in depth. Training matters. But tools, internet access, permissions, monitoring and the environment around the model matter too.

China is also beginning to regulate this problem

Moonshot's decision arrives at an interesting moment in Chinese AI policy.

On October 16, China's Ministry of Commerce and Ministry of Science and Technology proposed changes to the country's technology-export rules. Among the technologies proposed for prohibition is AI-driven malicious-code generation and mutation technology. AI-assisted vulnerability-discovery technology is among the areas proposed for restricted export. These changes remain proposals under consultation until November 15; temporary export pre-registration for the listed technologies took effect on October 16.

The government specifically said these kinds of capabilities could potentially be used against critical infrastructure, defence systems and important government networks.

At the same time, the proposal does not simply oppose open AI. The ministry also says it wants to encourage open-source development and international cooperation, and proposes easier licensing arrangements for some open technology. Technology already placed into the public domain through open-source release or academic publication may also receive different treatment.

This produces an interesting policy tension very similar to Moonshot's technical problem. China wants strong AI. It wants Chinese AI to be used internationally. It supports open development. But it also does not want the most dangerous capabilities spreading without control.

There is currently no evidence that the Chinese government's proposal directly caused Moonshot's decision about Kimi. The timing alone does not prove that. But the two developments clearly belong to the same larger debate.

Cyber AI is becoming powerful very quickly

The concern is not theoretical. The UK AI Security Institute says the gap between the cyber capabilities of leading open-weight models and the strongest closed models has been shrinking.

In July 2026, its testing of GLM-5.2 and DeepSeek V4-Pro found leading open models roughly comparable to closed models released four to seven months earlier. The gap measured through most of 2025 was six to ten months. This is historical context, not an independent evaluation of Kimi K3.1 Pro.

AI cyber capability is also moving beyond answering cybersecurity questions. Researchers increasingly test whether agents can complete long chains of actions inside simulated networks: finding vulnerabilities, moving between machines, maintaining access and reaching an objective.

That is a different level of capability. An AI that explains cybersecurity is useful. An AI that can autonomously perform hours of cybersecurity work is something else. And again, that ability can protect systems or attack them.

Why the Decision Is Not a Complete Solution

It would be easy to describe Kimi K3.1 Pro as a 'safe' cyber model because Moonshot reduced its score from 90.5% to 81%. That would be misleading.

The model still appears powerful. The benchmark is internal. The results have not yet been independently reproduced. The weights have not yet been publicly released. We do not know how difficult it will be to rebuild the removed capability. And cybersecurity is only one form of possible misuse.

Moonshot itself does not claim the problem is solved. In fact, its position is more unusual than that. The company says it intends to progressively raise the cyber capability available in open-weight models over time, arguing that defenders also need powerful models to inspect vulnerable software, especially old systems that rarely receive enough security attention.

That means Moonshot is not drawing a permanent line. It is trying to control the speed at which the capability spreads.

A New Question for Open AI

For years, the debate about open AI often sounded simple. One side argued that powerful AI should be open because openness supports innovation, research, competition and transparency. The other side argued that powerful models need tighter control because dangerous capabilities become harder to contain once anybody can download them.

Kimi K3.1 Pro shows that the real problem may be more complicated. The question may no longer be: Should powerful AI be open or closed? It may become: Which capabilities should an open model contain at the moment it is released?

That is a much harder decision. Coding ability and hacking ability overlap. Biological understanding can support medicine or biological misuse. Autonomous agents can protect networks or attack them. The intelligence that makes a model useful can sometimes be the same intelligence that makes it dangerous.

Moonshot appears to be experimenting with a middle position: build the powerful model, measure where dangerous capabilities emerge, keep ordinary useful skills, reduce particular capabilities before releasing the weights, and then allow more capability to spread gradually as society's ability to defend itself improves.

Whether that approach works is still unknown. But the experiment itself matters.

Because once a frontier model's weights are released, the safety question changes from: 'Can the company control this model?' to: 'What did the company put inside it before central control over distributed copies was lost?'

If Moonshot meets its announced November 4 deadline for releasing Kimi K3.1 Pro's weights, independent researchers will be able to begin answering that question. The most interesting test may not be how intelligent Kimi is. It may be whether the abilities Moonshot deliberately left behind stay left behind.

Sources

Company statements are treated as evidence of what the company reports, not independent proof of every result. Where important claims have not yet been independently reproduced, the article says so.

[1] Moonshot AI. Introducing Kimi K3.1 Pro. Official technical release describing the model, cyber-data removal, xdev-bench-hard and the 90.5% versus 81.0% results. Open source

[2] Reuters. Moonshot curbs hacking ability in new Kimi model as fears grow over AI-powered cyberattacks. 24 October 2026. Independent reporting on the release and its cybersecurity implications. Open source

[3] UK AI Security Institute. How Far Behind the Frontier are Leading Open Weight Models on Cyber?. Research comparing cyber capabilities and security properties of open- and closed-weight models. Open source

[4] ICLR 2026. Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs. Experimental research on reducing dangerous knowledge through training-data filtering. Open source

[5] ICLR 2025. Tamper-Resistant Safeguards for Open-Weight LLMs. Research on how conventional safeguards can be vulnerable to later fine-tuning and stronger protection methods. Open source

[6] China Ministry of Commerce. Statement on proposed revisions to China’s Catalogue of Technologies Prohibited and Restricted from Export. 16 October 2026. Official policy explanation covering AI malware generation, vulnerability discovery and treatment of open technology. Open source