Moonshot Cut Cyber Training Data From Kimi K3.1 Pro Before Releasing Its Weights

As of October 26, 2026.

Moonshot AI says it made its newest open-weight model worse at exploit work on purpose, by taking cyber data out of training. The weights ship by November 4, so the cut travels with the model to everyone who downloads it.

What Moonshot did

On October 24 Moonshot introduced Kimi K3.1 Pro, a 3T-class model with a 1-million-token context window. It is live on Moonshot's products and API now; "Full model weights will be released by Nov 4, 2026."

The post's Cybersecurity section says Moonshot found cyber content mixed into its general mid-training corpus and cyber tasks in its RL environments, "a natural byproduct of training on broad data." For the open-weight release, it "identified and removed cyber-related data from both training stages, while retaining the general-purpose coding tasks needed for model usefulness."

It measured the effect on xdev-bench-hard, an in-house benchmark of exploit tasks built from recently disclosed bugs in software such as the Linux kernel, Node.js, JavaScriptCore and Exim. Each task gives the model the vulnerable source, a short bug hint and the binary, and the model must reach arbitrary code execution in a sandbox. A checkpoint trained without the data removal solves 90.5% at pass@3. The released model solves 81.0%.

Moonshot states its rule plainly: "we aim not to release open weights that would extend the absolute frontier of cyber capability." It also says it intends "to progressively raise the cyber capability available in open weights," and that K3.1 Pro's cyber capability "remains behind that of frontier proprietary models that have been publicly available for at least three months."

These are the vendor's own numbers on its own benchmark; Reuters, reporting the release, notes that "The results have not been independently verified."

What the timeline does not show

On October 20 DHS published an order excluding DeepSeek products from federal civilian procurement and removing them from agency systems. Four days later Moonshot, another Chinese lab, announced a model with its cyber skill turned down.

That is a juxtaposition. Nothing on the record shows one caused the other, and several facts point against it:

• Moonshot gives a different reason. Its post frames the cut as reducing "potential misuse risk" and never mentions DeepSeek, the US, or any government order. Neither does the Reuters report.
• The training change came first. Moonshot made the cut in mid-training and RL, which happen before a model is announced. It gives no dates, but a training-data change almost certainly predates a notice published four days before launch.
• The DHS order is older than it looks. The Congressional Research Service (October 23) says the Federal Register notice carries Exclusion and Removal Order #2026-01, dated July 24, 2026, and that the Defense Department issued its own DeepSeek order on September 8.
• The DHS order is about supply chain, not hacking skill. CRS lists its reasons: DeepSeek is subject to PRC law, account sign-up collects personal data, and the company collects inputs and outputs that could reach US adversaries. Offensive cyber capability is not among them.
• A more direct, cyber-specific pressure exists at home. On October 16 China's commerce and science ministries proposed export controls that would ban export of AI-driven malicious code generation and mutation technology and restrict AI-assisted vulnerability discovery. The draft also excludes technology already made public through open source, so how it would apply to open weights is unclear.

Moonshot has not said which of these, if any, mattered.

Withholding competence, not adding a refusal

Most model safety for cyber work is a refusal: the model can write the exploit but has been trained to say no. On a hosted model that can hold, because the vendor controls the weights and can patch the refusal. On open weights it is weak, because a refusal can be fine-tuned away cheaply by anyone holding the weights.

Moonshot did something different. It removed the data that builds the skill before release, so the released model is less able to do exploit work, whatever it is willing to do. A missing capability probably costs far more to restore than a refusal costs to strip, because restoring it means assembling the cyber data and training compute Moonshot held back. Nobody has yet measured that cost for K3.1 Pro.

So this is a case study in governance shaping what an open-weight model can do, beyond what it will say.

The lever is also partial, by Moonshot's own account. 81.0% is still a high score on exploit tasks, and Moonshot says K3.1 Pro beats its predecessor there, "indicating that stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal." Cutting cyber data held the skill back, yet general coding gains still lifted it above the previous model.

What this means if you build with coding agents

If you self-host an open-weight model for coding, the question is whether a model trained to be worse at exploits is also worse at the security parts of normal work: spotting the bug in review, judging whether a fix closes it.

Moonshot's post does not answer that. It says it kept "the general-purpose coding tasks needed for model usefulness" and reports gains across coding benchmarks. But xdev-bench-hard hands the model a bug hint and scores the exploit, so it says little about finding a bug unprompted, and the post's text gives no code-review or bug-detection score. It is an open question.

What to do now:

1. Test models on your own security tasks. Take bugs your team has fixed, roll back the fix, and see whether the model finds and repairs them in review. A headline benchmark does not tell you that.
2. Read vendor numbers as vendor numbers. The 90.5% and 81.0% come from Moonshot's in-house benchmark and have not been checked by anyone else.
3. Know which models your tools run. The DHS order covers "third-party products and services developed using DeepSeek implementations," and CRS says it extends to federal contractors. If you sell to the government, a coding assistant, scanner or agent platform built on DeepSeek can matter even though you never chose DeepSeek. Ask each vendor what model sits underneath, as you would for any dependency in your AI supply chain.
4. Watch the November 4 release. Public weights let outside researchers measure what was removed and how easily it comes back.

The bigger shift

Most of the open-weight safety debate has been about refusals and who gets access. Moonshot is betting on a third control: choosing what a model learns before it ships. That puts a new question to anyone picking a model: what was left out, and does your work depend on it?