Moonshot released Kimi K3.1 Pro (3T-class, 1M context) in its apps and API on Oct 23 and says full weights will be published by Nov 4. Its tech blog says vulnerability-research skill rose steadily with post-training, traced it to cyber content in the mid-training corpus and cyber tasks in the RL mix, and removed both for the open release while keeping general coding.

• On Moonshot's in-house xdev-bench-hard (exploit real recent bugs in Linux, Node.js, JavaScriptCore, Exim and VirGL with mitigations on, to arbitrary code execution), the unfiltered checkpoint scored 90.5% pass@3 and the released model 81.0%. Per TNW, K3 scored 33.3%.
• Moonshot says its policy is not to release open weights that extend the absolute frontier of cyber capability, and that K3.1 Pro stays behind frontier proprietary models that have been public for at least three months. It also says it intends to "progressively raise" the cyber capability available in open weights.

Defender takeaway: once the weights ship, a model that by its maker's own numbers exploits most of a hard real-bug benchmark will run with no usage monitoring. Data filtering reduced the capability but didn't remove it. Plan for faster exploit development against newly disclosed bugs, not for a model that can't do it.