Local AI Advisor
All posts

Moonshot cut Kimi K3.1 Pro's hacking skills before opening it — can fine-tuning put them back?

Moonshot removed cyber data from Kimi K3.1 Pro's training before its November 4 open release — here is what the cut does, and what it cannot stop.

By Ray, Your Local AI Advisor5 min readnew-modelsannouncementsai-newsbeginnerslocal-llm

Moonshot AI's Kimi K3.1 Pro arrives with an unusual feature: something deliberately left out. When the company announced the model on October 23, it said it had removed cyber-related data from the model's training before release. The full weights are still promised by November 4, but the version anyone can download will be weaker at finding and exploiting software vulnerabilities than the version Moonshot's own pipeline could have produced. Reuters covered the decision on October 24, and it raises a question every open-model user should understand: once weights are public, can fine-tuning put a removed capability back?

A glowing cube of connected nodes on a workbench with shears trimming dark tangled wires from one corner

What Moonshot actually removed

Moonshot traced the model's growing vulnerability-research skill to cyber-related content in two places: the general mid-training corpus and the reinforcement-learning environment mix. In early experiments, the company found that keeping that data in either stage raised downstream cyber capability substantially. For the open-weight release, it removed the cyber-related data from both stages while keeping the general-purpose coding tasks that make the model useful.

Moonshot measured the effect on xdev-bench-hard, its in-house test of expert-curated vulnerability discovery and exploitation tasks. Each task reproduces a recently disclosed vulnerability in software such as the Linux kernel, Node.js, JavaScriptCore, Exim, or VirGL, and the agent must develop an exploit, achieve arbitrary code execution in a separate sandbox, and retrieve a secret string. Scores are pass@3, meaning up to three attempts per task, with no hard timeouts or output-token limits.

The numbers, all from Moonshot's own blog post:

  • A checkpoint trained without the cyber-data removal solved 90.5% of tasks.
  • The shipped Kimi K3.1 Pro solves 81.0%.
  • The predecessor, Kimi K3, solved 33.3%.

Bar chart of xdev-bench-hard scores: Kimi K3 33.3 percent, Kimi K3.1 Pro 81.0 percent, unfiltered Kimi checkpoint 90.5 percent

Two things stand out. First, the cut cost 9.5 points — a real reduction, not a rounding error. Second, the shipped model still scores far above its predecessor, because stronger general coding and long-horizon debugging skills carry over to cyber tasks even after targeted data removal. Moonshot is open about that too: it says K3.1 Pro's cyber capability remains behind that of frontier proprietary models that have been publicly available for at least three months.

Why a training cut is different from a filter

Most model safeguards you hear about are filters added after training: refusal training that teaches a model to decline certain requests. Those are easy to strip once weights are public. There is already precedent — a repository of a stripped GLM-5.3 build was taken down from Hugging Face in October, and at least one group has announced plans to remove K3.1 Pro's safeguards after release.

Removing training data is a deeper cut. The model never learned those specific patterns in the first place, so no prompt trick or refusal-removal restores them. That is the honest case for what Moonshot did: it lowered the ceiling, rather than just locking a door.

But it is not permanent, and Moonshot does not claim it is. Its blog post does not address whether fine-tuning could restore the removed capability. Fine-tuning — training the released weights further on new data — can teach skills the base model lacks, and cyber training data is not hard to find. How much of the 9.5-point gap a fine-tune could close is untested, and it will stay untested until the weights actually land on November 4. Anyone who tells you the answer today is guessing.

Moonshot's stated principle is worth quoting exactly: "We aim not to release open weights that would extend the absolute frontier of cyber capability." The company also says it intends to progressively raise the cyber capability available in open weights over time, arguing that more teams able to audit the code they maintain — including legacy systems that rarely get security reviews — ultimately makes software more secure.

What this means for you

For most readers, the cut changes little day to day. K3.1 Pro remains a strong coding model — 81.0% on Moonshot's own exploit test, and near the top closed models on Terminal-Bench 4.0, as covered in yesterday's post. The removed capability matters mainly if you planned to use the model for security research, and for that work the hosted API version is the same trimmed model — the cut is in the weights, not in an API filter you can bypass.

The practical things to watch when the weights land on November 4:

  1. The license and the file size. Both are still unconfirmed, and they decide who can legally use the model and on what hardware. At 2.8 trillion total parameters, this is not a model that runs on a home PC in any case — the local angle is hosted providers serving the weights, and smaller distilled versions that may follow.
  2. The first community fine-tunes. If a fine-tune measurably restores cyber capability, that tells you how durable training-data removal really is. If none appears, or if restored versions underperform, that tells you something too.
  3. Your own defensive use. Moonshot's own argument for the release is the one that applies to local users: an open model running on infrastructure you control can audit code you maintain, without sending that code to someone else's servers. The trimmed model still does that job.

The bottom line

Moonshot's cyber cut is the first time a frontier-class open release has shipped with a measured, disclosed capability reduction — 90.5% down to 81.0% on its own test. That is a real, honest number, and it is also not a guarantee: fine-tuning may claw some of it back, and nobody will know until November 4. The takeaway for local AI users is to judge the model by what the released weights actually do, not by what the announcement promises or what the unfiltered checkpoint could do. When the weights land, this blog will check the license, the size, and the first fine-tunes — and report what changed.

Sources