What is in the Kimi K3.1 Pro open-weight release, and what changed from K3?

Moonshot AI has kept its date. When it launched Kimi K3.1 Pro as a hosted service in late October, the Beijing company said the full model weights would follow by November 4. They are now in a public, ungated Hugging Face repository, moonshotai/Kimi-K3.1-Pro, whose first upload is dated November 2. Anyone can download the files without asking permission. Weights are the learned numbers that make up a model; having them means you can run, study and modify it on your own machines.

K3.1 Pro is not a new architecture. It is Kimi K3, released in July, trained much further with reinforcement learning, a method where the model practices tasks and is rewarded for good results. The release matters because it puts a model Moonshot rates close to the best closed systems into anyone's hands, along with an unusual safety step: the company says it removed training data on hacking before publishing the weights.

What was released

The repository holds the weights, the configuration, the tokenizer, code to process images and a model card. The main figures, from that card:

A parameter is one learned number. Both are mixture-of-experts models: each layer holds many small sub-networks, the experts, and a router sends each token, a small piece of text, to a few of them. That is why only 104 billion parameters do the work for any one token while all 2.8 trillion must sit in memory.

The one structural change is in attention, the part of a model that decides which earlier words matter for the next one. Moonshot replaced K3's full-attention layers with a sparse kind called Gated DSA, which looks at a selected subset of earlier tokens instead of all of them. The model card says this makes very long inputs cheaper to process.

How the model was changed, including the cyber cut

Moonshot's launch post describes K3.1 Pro as K3 with substantially more post-training compute. Its own reported results, which are claims rather than independent tests:

Moonshot notes that the hallucination test is a stress test built to provoke mistakes, so its rates are not everyday error rates.

The more unusual part is cybersecurity. Moonshot says it noticed the model's skill at finding and exploiting software flaws rising as training went on, traced it to hacking-related material mixed into general training data and practice tasks, and removed that material from two training stages for the public release. On its in-house exploit test, the version trained without that filtering solved 90.5% of tasks within three tries, against 81.0% for the released model. Moonshot says the result stays below what its pipeline could produce and behind closed frontier models that have been public for at least three months.

That approach has limits worth stating. Once weights are public, anyone with enough hardware can fine-tune the model on the removed material again, so filtering raises the effort required rather than closing the door. And the 81.0% figure shows the released model is still strong at the task, a point Moonshot itself makes when it argues that defenders benefit from open access.

The licence: K3's terms with a new name

Comparing the two licence files line by line shows only the model name changed. The Kimi K3.1-Pro License grants broad rights to use, modify, fine-tune and sell, with two conditions:

So everything in our Kimi K3 licence guide applies unchanged. It is permissive for most teams, but it is not a standard open-source licence such as MIT or Apache 2.0, because of the model-as-a-service clause.

What it takes to run

The download is the same size as K3, so the hardware bill is too. The vLLM project's setup guide for K3.1 Pro lists a baseline of eight GPUs working as one group: two NVIDIA GB300 trays, one B300 server, or one AMD MI355X server, with vLLM version 0.34.0 or later. Its default example spreads the model over two machines.

A quick sense of scale: 1.56 TB of weights divided by 80 GB, the memory on an NVIDIA H100, means about 20 such cards just to hold the model, before any room for conversations. A 1-million-token context needs a great deal more on top. This is data-centre equipment, far beyond a workstation.

Should you self-host Kimi K3.1 Pro or use it through an API?

For almost everyone, an API is the practical route. Moonshot's own Kimi API serves K3.1 Pro and a faster Highspeed variant through calls compatible with OpenAI's and Anthropic's formats, so testing often means changing an address and a model name. Hosted use also falls outside the licence's conditions when it goes through Moonshot or its certified partners. The trade-off is data: prompts sent to Moonshot's service fall under its terms, so read them before sending anything confidential.

Self-hosting makes sense for organizations that already run multi-GPU clusters and need their data to stay on their own machines, or that want to fine-tune the model. In that case the open weights deliver what a hosted service cannot: no prompts leave your network. Our guide to choosing between an open-weight model and a hosted one walks through that decision step by step.