Kimi K3.1 doesn't have the ability to remove the attack.

First, the conclusion is that:This time there was no "de-attack capability" and there was no sign of a "genius infiltration test engineer going down."

The dark side of the moon, the words are:They found that the training data incorporated a number of security features, and then they were picked out and deleted in two stages: Mid-training and RL.

After that, their own internal penetration benchmark dropped from 90.5 per cent to 81.0 per cent.

Dropped 9.5 points. Relative decline 10.5 per cent.

And?81.0 per cent is still 2.4 times higher than 33.3 per cent of their predecessor K3.

So the term "removing the ability to attack" is a logical level with "the man gets stupid because he's down 95 to 90."

First, let's see what's been deleted.

Most of the recitations on the Internet stop at the phrase "Kimi removes the ability to attack." The official text is actually very specific, and I'll take it down:

First, they find out where the power comes from.

As the scale of training has expanded, the capacity to research loopholes has steadily increased. Retroactive source discovery -The cyber content is embedded in the generic mid-training language, and the cyber task is also in the RL environment. The government uses a very frank phrase: "This is a natural by-product of training in a wide range of data."

Step two, they did a comparison experiment.

Validation on internal models: If the mid-training and RL phases are not removed, downstream cyber capacity increases significantly.

Step three, they did it in the open source.

For the open-weather request of K3.1 Pro, we agreed and moved cyber-related data from both training events, while remaining the general-propose coding tools needed for model use.

Note the last sentence, "The generic programming tasks required for the usefulness of models are retained".

This sentence is the most critical in the text.They deleted "data specifically pointing at the attack", not "all knowledge about code, systems, loopholes." The latter eliminates the model because the loophole itself is a code flaw.

So the exact answer is:It's not about removing the ability to attack, it's about removing the training bias of "direction to attack".

How far are those two things? Look at the next section.

Two, 90.5. It's a number never published.

This detail is almost missing.

Xdev-bench-hard, 90.5%, isDo not do the same cyber training tube for data removal Line"I'm going out of the checkpoint.

This checkpoint has never been published. It is not a generation product, not a public version, but a hypothetical product that exists only in internal control experiments.

In other words, the essence of this comparison is:

"We could have done 90.5, but we chose to publish 81.0."

This is one time.Public statement of self-restraintNot once.Report of accidents of degradation of capacityI don't know.

Combining these two things is the biggest distortion of the cycle.

Full master:

Model	xdev-bench-hard (pass@3)
GPT-5.6 Sol	100%
Kimi (checkpoint without cyber data removal)	90.5%
DeepSeek-V4.1-Flash	85.7%
Kimi K3.1 Pro (actual release)	81.0%
GM-5.3	57.1%
Kimi K3 (former generation)	33.3%

There are three counterintuitive facts in this table, I say.

Three or three neglected facts, each reversing a popular one.

Fact one: The one that was deleted, 90.5, you never downloaded.

So you didn't "lost" anything. You know, "They could have done more, but they chose not to."

This is a statement of security, not a loss of capacity.

Fact 2: After it was deleted, it was 2.4 times stronger than the previous generation.

81.0 Yes, 33.3. That number is in the title, and the narrative of the whole thing is exactly the opposite --

It's not Kimi getting weak, it's Kimi getting stronger, but not to the point where he can.

Fact III: There is already an open source model higher than that.

DeepSeek-V4.1-Flash, 85.7 per cent.

So the inference that "other models will remove the ability to attack" is de facto irrelevant.The list contains a 4.7-point-high national production model.

If you say trends, trends are:The head closed source model is 100%, the open source is between 81 and 86, and everyone is squeezed in the same scale.

This is a completely different picture from "collective castration".

IV. WHAT THE BASE IS (and it can't measure anything)

This paragraph is the one I want the most.

Xdev-bench-hard gives you three things:

1. Source code with loopholes
2. A bullet hint
3. Corresponding Binary

The requirement is to write an expluit, get any code executed in the independent sandbox and retrieve a secret string for automatic rating.

The source is Linux kernel, Node.js, JavaScriptCore, Exim, VirGL, the real software. Lee.Recent revelationsAnd...It's all on mitigation.I don't know.

This thing is hard? Hard. The use of mitigation measures is really hard.

But its shape is nothing like real penetration.

The real infiltration took a long time:

Set the scope, touch the assets, find the entrances, dig the business logic gaps, move horizontally, draw on the evidence, write reports, explain to the client.

And xdev-bench-hard only covers a small right in the middle:"I know there's a hole in here, shoot it down."

Where the real money is, the steps ahead...

• The client's asset list is wrong. You have to do it yourself.
• An internal tool that looks harmless. It's a power hub.
• There's no CVE, no hint, no binary, just a hunch that makes you feel "how is this weird?"
• We'll have to prove the impact.

None of these can be measured.

So when someone says, "AI replaced the infiltration test engineer," my question is:Which part did you replace?

If it's the "exploit after a hint of a loophole," it's true, AI is faster than most people. This happened two or three years ago.

If it means "to find the most worthwhile spot in the face of a strange, ill-defined, borderless real system,"Far away.

V. Why does this self-embracing make sense in engineering?

The decision on the dark side of the moon, from a purely engineering point of view, is rational.

First, the open source weight is irrevocable.

A closed-source model found that it was too capable to add a fence, a limited number and a closed API.Once the open source weights are released, the world can download them and never get them back.

So the only risk control that can be done with open source models is...Before it goes out.I don't know.

Secondly, their objectives are well articulated.

"We"No, I'm not.The launch expands the open source weight of the absolute front line of cyber capacity.

Attention to the term "absolute front". Not "no attackable models" but "no model that puts the industry ceiling up top."

The difference between the two lines is enormous. The former is tantamount to a dereliction of martial arts, while the latter is simply an improper head.

Thirdly, they committed themselves to the opposite.

Article 2: "We intend toGradual increasecyber capabilities available in open source weights.

Article 3 explains the rationale: to enable people who need dual-use capability to useDefenseI don't know. A powerful model open source, running on a user-controlled infrastructure, allowing more teams to audit their own maintenance codes -These include legacy systems that have almost never been subject to a specific security review.

This is not a public relations statement.The security debt of the legacy system is one of the most real pains of the Chinese Internet. A self-run audit tool for the defence is available on the Intranet, and the proceeds are real.

So it's not castration, it's speed limit. The direction is still forward, just a brake.

Six, it's not the power that really worries. It's three things.

If I'm a safety practitioner, I'm not worried about being stupid.

I'm worried about three things:

1 The cutting effect.

The upper limit of the capability of an open source model is subject to a " current front-line closed source model at a level of three months ago " .

"K3.1 Pro's cyber capacity is still behind those."It's been publicly available for at least three months.The front-line closed-source model.

This "at least three months" isn't random.It's a time gap.I don't know.

What does it mean to the defense? MeaningThe most powerful open-source tools you can get are always three months behind the best tools the attackers can buy with money.

This gap does not disappear as a result of the choice of a particular manufacturer, and it is normal at this stage.

2 Transparency of data sources collapsed.

The most valuable part of this announcement is actually not the 81.0.It admits that cyber's power comes from the natural by-product of the common language.I don't know.

Translator: You want to teach a model that's leaking, you don't need to feed data.Feeding enough code and system knowledge, it does.

That means "dismantling data" for the long term.It's going against the laws of physics.I don't know. You've deleted the obvious defensive material, and the generic code capability will spill over into the attack capability -- 81.0 on the list, which is evidence in itself.

Benchmarks and realistic cracks will grow.

The factory's chambers of commerce continue to maintain their internal benchmarks (officially known as “keyp evolving our international benchmarks”) because the existing benchmarks lose their distinction once they are fully filled.

But...The more precise the baseline, the further away from the real scene.I don't know. There is no "bug hint" for real penetration, no "negative binary" for "retribution" for "secret string".

So the benchmark scores are going to be higher and the model "can finish a real project for you" will appear later than you expected.

vii. Back to the question: Will infiltration test engineers fall?

Nope. But...The job will be redistributed.And it's already happening.

My judgment is in three:

They'll be replaced:

• PC / extloit
• Mass code static audit first.
• Duplicate configuration verification, baseline inspection
• Those parts of the report that "replicate to change a client's name"

It won't be replaced:

• To judge where this system is most worth fighting for -- it requires business understanding and trade-offs.
• Re-establishment of asset recognition in cases where the asset list itself is wrong
• "Are you going to fix this risk or not?" It's politics, not technology.
• Take responsibility.Something's wrong. It's signed by someone.

It will be magnified:

• One person + a bunch of parties that can cover the breadth of a previous team
• The point is,Can you verify the output of angent?I don't know. Validation capacity becomes new core skills.

So the real problem is not to predict, but...It understands penetration testing as writing expluit.I don't know.

That understanding was outdated before AI appeared.

Eight: I'll give you the real parameters of this model.

Since it's about this model, a few numbers are actually used:

Item	Kimi K3.1 Pro
Parameters	3 trillion.
Context	1M (1,048,576 tokens)
Enter Price	¥13/ Million token
Output price	68/ million token
Cache	¥ 1.30 / Million token
Cache Write 5 Minutes	¥13/ Million token
Cache written 1 hour	¥26 / Million token
Express	Consistency, 2-3 times speed, double price (¥26/¥136)
Weight Publication	4 November

The price is entered. 5.2 timesThe price of the cache is entered. 1/10I don't know. This is the standard long context + Cache Priority pricing structure:The longer your system moves, the more stable it is, the greater the savings.

There's three more hard limits. Those who step on it will hurt.

• temperature Fixed 1.0I don't know.top_p Fixed 0.95If you pass on another value, you'll miss it.
• Multi-cycle conversations must be returned in full as they areincluding reasoning_contentI don't know. If you miss it, you start talking nonsense.
• Visual inputImage URL not supported, only base64 or ms://

And the last one, I guess, is that a lot of people would step on it: you throw a photo link to it, and it doesn't download it, and it just goes wrong.

Finally.

In this bulletin, I think it is not 81.0 or 90.5 that is most worth remembering.

That's it:"We intend to gradually increase the capacity of cyber available in open source weights."

Because it admits a premise...Capabilities can be regulated, not simply liberalized or sealed.

In the past two years, there have been only two positions in the industry on this matter: full or no.Kimi gave a third position this time: open, but slow, and publicly indicated how much.

You can't agree with this speed. But at least it put it on the table and told you where it was.

It's a lot more honest than the unspoken, silent refusals at RLHF.

As for the "genius infiltration test engineers," they don't fall.

It's going to happen to people who've only been able to "scanning the scanner and changing the payload" for the last 10 years.This happened before AI appeared, AI just pushed the schedule two years ahead.