1. Home
2. News
3. Open weights

Moonshot's Kimi K3.1 Pro lands just behind Claude Opus 5.5, with open weights due November 4

Moonshot stripped cyber training data from the open release, and says that cost it nearly ten points on its own exploit test.

By Think Facility · October 23, 2026 · Moonshot AI Open weights Save

On October 23, 2026, Moonshot AI released Kimi K3.1 Pro, which it calls its most capable 3T-class open-weight model, with a 1-million-token context window. It's live now on Kimi.ai, Kimi Work, Kimi Code and the Kimi API. The weights aren't out yet: Moonshot says it'll release them by November 4.

On the one independent score that's out so far, it sits right behind the best closed model. Artificial Analysis put it at 55, Simon Willison reports, behind only Claude Opus 5.5 at 58 and ahead of Claude Fable 5.1, GPT-6 Astra and Gemini 4 Argon at 53. Willison calls it the first time a soon-to-be open model has scored this highly against the frontier.

Size

2.8T total / 104B active params (MoE)

Context

1M-token

Price

$2.00/million tokens for input and $10/million for output

Open weights

by Nov 4, 2026

Terminal-Bench 4.0

65.7%, narrowly behind Claude Opus 5.5 (66.4%)

What Moonshot says it can do

K3.1 Pro is K3 with much more post-training, using reinforcement learning across hundreds of domains at once. On Terminal-Bench 4.0, a test of coding agents on terminal tasks, Moonshot puts it at 65.7%, ahead of GPT-6 Astra's 58.2%. Those are Moonshot's own runs for Kimi (with the Claude Code harness) set against figures the other labs or the leaderboard published.

Its best example is a long one. Working from an open anatomical model with 296 skeletal and 402 muscle components, K3.1 Pro spent 167 missions getting a simulated human to walk, from collapsing within seconds to striding for 11.2 seconds. When tuning the reward stopped helping, it went looking at the simulator itself and fixed 36 errors in the shoulder-muscle calculations.

Moonshot's announcement on X led with the specs.

That 65% is from Moonshot's own stress test, where the claim-level hallucination rate fell from 23.4% for K3 to 8.3%. Moonshot is careful to add that the prompts are built to trip models up, so these aren't everyday error rates.

Why the open weights ship with cyber data removed

The part security people will read twice is about what Moonshot took out. During training it saw vulnerability research scores rising as post-training scaled, and traced that to cyber content in its general training data and cyber tasks in its RL mix. For the open-weight release it removed both.

It measured what that cost. On xdev-bench-hard, its in-house exploit-writing test, a checkpoint trained without the removal solved 90.5% of problems in three tries, and the final K3.1 Pro solves 81.0%. That's still well up on K3, which Moonshot puts down to better general coding carrying over into cyber work.

Moonshot says K3.1 Pro's cyber ability trails proprietary models that have been public for at least three months. It also says it plans to raise the cyber capability in open weights step by step, on the view that a gradual spread makes software safer overall. The same day, Anthropic and the UK's AI Security Institute published what happened when a model tested for cyber skills went after real developers (our story).

What changes for the people who use it

The price is $2 per million input tokens and $10 per million output, the same as GPT-6.1 Sol and half what Claude Opus 5.5 costs, according to Willison. A Highspeed version runs 2 to 3 times faster for twice the price (cached input costs the same). API customers can get zero data retention, and business admins have to switch the model on, since it's off by default.

Willison tried it through Moonshot's API on launch day and posted his verdict on X.

Arena put K3.1 Pro 8th in its Code Arena for web development with 1,692 points. That matches Claude Opus 5 at maximum effort, Arena says, at 70% lower cost.

The weights are the bigger change, though. Moonshot's case is that a capable model running on infrastructure its users control lets many more teams audit the code they maintain, including legacy systems that rarely get a security review. For an organization that won't send its code to another company's servers, that's something an API can't offer.

Open weights also sit outside rules aimed at a single company. On October 20, 2026, the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products, including third-party products built using DeepSeek implementations (our story). The order names DeepSeek and its affiliates, and nothing in it covers Moonshot's models.

Arena says that once the weights are out, K3.1 Pro would be the top open model in that web development ranking, ahead of DeepSeek-V4.1-Flash.