In October, Moonshot AI released Kimi K3.1 Pro. Along with making the model stronger, the team did something that goes against the usual race for better performance: they made some of its skills weaker on purpose.
According to the company’s internal tests, without this step, the model could pass 90.5% of tests on using software security flaws. After the team removed that data from training, the final score dropped to 81.0%. By doing this, Moonshot hopes to lower the risk of people misusing the model once its weights are open.
Meanwhile, Chinese regulators are also changing the rules for sharing models abroad. In October, Beijing released a draft update to China’s technology export list and started requiring companies to register these technologies before sending them abroad.
Companies control what a model can do, while the government manages which technologies leave the country and how. Both face the same question: as open models get more useful, and more likely to be used for attacks, how can they stay open?
So, What Did Kimi Do?
Moonshot’s research team said the model got better at finding security flaws for two reasons. First, its coding skills improved. Second, its training data and reinforcement learning tasks included content on cyberattacks and defenses. So before opening the weights, the team removed that content from both parts of training, while keeping what the model needed for normal coding.
The score drop mentioned earlier came from an internal test that gave the model three tries at each task. It shows the cut worked, but it does not mean real-world attack risks also fell by 9.5 percentage points. Even after this cut, K3.1 Pro is still much stronger at these tasks than the last version.
This is the tough problem Moonshot faces: as a model gets better at coding, reasoning, and long debugging jobs, its cyberattack skills can grow right along with them. Deleting some specific data does not make those general skills go away.
In July, the UK’s AI Safety Institute (AISI) and the US Center for AI Standards and Innovation (CAISI) teamed up to test Moonshot’s last model, Kimi K3. They found that its safety rules failed to stop it from carrying out attack tasks. Even so, it was still clearly behind top US models. The report also noted that for closed US models, researchers turned off system-level safety guards to see the most they could do. So those test scores don’t show how the public versions actually work.
So wouldn’t it be simpler to just keep the model closed for safety?
Moonshot clearly doesn’t want to do that. Cyber skills can also help companies find and fix software flaws, especially in older systems that have gone years without proper security checks. Open weights let more companies run the model on their own servers, without relying completely on a few closed-model companies.
That choice makes sense, but it brings up new questions: How much do the skills used by attackers and defenders overlap? After this cut, how much of its ability to run normal security checks is lost? A lower score on an attack test isn’t enough to answer these questions.
Users already have mixed feelings about this move. Some complain that Moonshot is handing out a ‘watered-down’ model. They worry the company could use safety as an excuse to hold back its open-source version and sell an expensive closed version instead. Others worry a weakened model won’t be strong enough to test their own servers.
Beijing Draws a New Line
Kimi K3.1 Pro came out just one week before Beijing stepped in to manage large model exports. On October 16, the Ministry of Commerce released a draft plan to update its list of restricted export technologies, adding large AI models as a possible target.
This timing points to an unspoken understanding between Chinese companies and regulators. Officials likely gave companies an early heads-up before the rules came out, and companies adjusted right away to stay in line.
Under the draft plan, companies have to register first while officials keep discussing which technologies to limit. Public feedback runs from October 16 to November 15, giving both sides a month to adjust. However, temporary registration started the day the notice came out and will stay in place until the final list becomes official. Also, registering now is not the same as getting an export license later.
Even for technologies that may face limits, regulators are leaving a door open. The Ministry of Commerce said open-source projects will get fast-track approval, aiming to approve requests right after companies send them in. The rules also won’t apply to technologies that are already public through open-source releases or research papers.
Many see this relaxed ‘quick registration’ policy as a sign of support for Chinese open-source AI companies, though the exact timing and handling in practice remain unclear.
There is also a difference between exporting technology and serving foreign users. According to the Ministry of Commerce, the rules cover putting these models on local servers overseas. However, offering services through an API, website, app, or cloud software (SaaS) is not covered by these export rules.
Still, keeping the technology inside China does not always mean a company can skip registration. A company may still have to register if the owner or real boss behind the technology changes to a foreign person or company.
Regulators clearly care about more than just cyberattacks. They also care about who ends up controlling the technology. How China stepped in when Manus was sold to Meta proved this point. This kind of ‘Singapore washing’ is seen as taking Chinese technology and government money, only to cash out by selling the company to a foreign buyer.
Since the notice came out, reports say DeepSeek and MiniMax have already registered. That only shows the process has started, as regulators still haven’t shared more specific safety rules. Even so, people are already waiting to see Z.AI and Qwen do the same.
This brings up a more practical question: if you can download a model today, will you still be able to get its next update smoothly? Companies need rules they can count on, not a guessing game with policy before every release.
Why Critics Abroad Remain Skeptical
At least when it comes to sharing information publicly, Chinese AI companies still have a long way to go.
SemiAnalysis looked at 857 model releases from nine Chinese developers between 2021 and September 15, 2026. Researchers found public safety test results from the developer for only 31 of those models. And just 9 shared those results by the time the model came out. Still, the study noted that not finding public results does not mean companies didn’t test their models in private.
There is a practical reason for this gap. For a long time, Chinese AI labs focused on getting better results from their limited computing power. They only started learning about the real dangers caused by AI agents over the past three months. Meanwhile, Beijing’s existing hard rules mainly cover how AI apps affect everyday users, not what a model can do on its own.
So by sharing its training changes and test scores this time, Kimi at least gave the outside world something real to talk about. Still, a bigger question down the road remains: once a model is open, can people train those weakened skills back in?
Past studies have found that fine-tuning can break some safety guards that make a model refuse harmful requests or ‘forget’ dangerous knowledge. Meanwhile, other teams are trying to make those guards harder to remove. This does not prove Kimi’s method will fail, but it shows that testing a model before release is not the end of the story.
If more training can easily bring back dangerous skills, how much time does that first cut really buy? And if bringing them back costs a lot, is that enough to make attacks too expensive to try? Answering these questions takes extra testing. You can’t figure it out just from the two numbers 90.5% and 81.0%.
In the same way, export registration lets regulators know what the technology is, who is getting it, and what it is for. But it cannot directly control how people use a model after they download, change, and share it again. Companies and the government can each manage part of the process, but neither can fix the whole problem with a single move.
What Is Still Missing?
What I care about more is this: what kind of independent test can check both the promises of Chinese companies and the warnings from outside researchers?
You can’t judge this simply by where a team is from. A company’s own tests need to be double-checked, and outside labs also need to explain how they ran their tests. Which version was tested, how many tries it got, whether safety guards were turned off, and whether others can get the same results all change how we read the numbers.
Policy also faces a real-world test. Will automatic approval run smoothly, which updates need a new review, and can companies know the rules ahead of time? Those answers will decide how willing overseas users are to rely on Chinese models.
One key signal to watch over the next six months is whether Chinese AI labs start sharing their own safety test results, or team up on voluntary safety standards across the industry. That could help make up for the past lack of attention to safety risks in Chinese open models.
Still, China does not have independent third-party safety evaluators right now, and I doubt Chinese labs will readily trust similar groups abroad.
Trimmed open models and export tracking are only a first step, and neither has proven that this balance can last. Between attackers and defenders, we still don’t know who will gain faster as these skills spread.
Three tries per task is the detail that makes 90.5% hard to read. Give any model several attempts and the pass rate climbs, so the 9.5-point fall describes a generous test, not one real try at breaking something. The cut also removed training content, and as the post says, that doesn't erase the coding skill underneath. Did Moonshot publish a single-attempt figure anywhere?