Kimi K3.1 Pro: Free to try, hacking skills deliberately weakened

Moonshot AI released Kimi K3.1 Pro on Friday, the first model in its new K3.1 series. According to the company's tech blog, it is rolling out across Kimi.ai, the Kimi apps for iOS and Android, the Kimi Work desktop app, the Kimi Code coding tool and the Kimi API. You can try it for free. Moonshot's pricing page lists K3.1 Pro on the free plan with "Limited usage" on the web and in Kimi Work, but does not say how much free usage that covers. K3.1 Pro Highspeed, which Moonshot says is two to three times faster, requires the Pro plan or higher.

Close to Claude Opus 5.5 on coding

K3.1 Pro is a post-trained version of Kimi K3, which launched in July, with substantially more compute spent on post-training. Moonshot describes it as a mixture-of-experts model with 2.8 trillion total parameters, 104 billion of them active per request, and a context window of 1 million tokens. On Terminal-Bench 4.0, which tests coding agents on terminal tasks, Moonshot reports a score of 65.7%. Claude Opus 5.5 scores slightly higher at 66.4%, while GPT-6 Astra reaches 58.2%. These are the company's own figures. On the independent Artificial Analysis Intelligence Index, K3.1 Pro scores 55 according to Simon Willison, compared with 58 for Opus 5.5. API access costs $2 per million input tokens and $10 per million output tokens, a third less than Kimi K3.

Moonshot removed attack-related training data

The blog post spends an unusual amount of space on cybersecurity. Moonshot says it saw the model's ability to find and exploit vulnerabilities improve steadily as post-training scaled. It traced this to cyber-related content in the general training corpus and to cyber tasks in its reinforcement learning environments. For the open-weight release, the company says it "identified and removed cyber-related data from both training stages," while keeping the general coding tasks the model needs.

Moonshot measured the effect with xdev-bench-hard, an in-house test in which an AI agent has to exploit recently disclosed vulnerabilities in software such as the Linux kernel and Node.js. A checkpoint trained without these measures solved 90.5% of the tasks, and the final K3.1 Pro solved 81%. The capability is still there. According to The Next Web, the original K3 scored 33.3% on the same test. Moonshot says K3.1 Pro still trails closed frontier models that have been publicly available for at least three months. None of these numbers has been independently verified. Anthropic showed in early October how quickly open models are catching up when it tested GLM-5.3.

Open weights due by November 4

The planned open release is the reason for the extra effort. Moonshot says the full model weights will be released by November 4, and no K3.1 version was listed on Hugging Face as of Sunday. Once published, open weights cannot be withdrawn, and built-in safeguards can be stripped out by others. A Hugging Face page from a company called Audn AI already announces plans to remove K3.1 Pro's safeguards after release, as it did with GLM-5.3. Removing safeguards cannot add back capabilities the model never learned in training. Moonshot writes that it aims "not to release open weights that would extend the absolute frontier of cyber capability," but intends to raise the level available in open models step by step.

A model this size won't run on a regular PC or laptop anyway. Anyone trying K3.1 Pro is therefore using Moonshot's servers, and the company only mentions a zero data retention option for API customers. Our guide explains what to consider before using Chinese AI services such as Kimi and DeepSeek.

I write about IT security and artificial intelligence. Cybersecurity is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I have worked hands-on with AI for years, most recently with a focus on AI agents and their use in everyday work, and I test tools and models myself rather than just reading about them.