Kimi K3.1 Pro lands just behind Opus 5.5 on Terminal-Bench

Kimi says that removing cyber-related training data dropped K3.1 Pro from 90.5% to 81.0% on its in-house exploit benchmark. The company made that cut for the open-weight release of the model, which it announced on October 23. The other figures are in the same launch post on Kimi’s blog: 65.7% on Terminal-Bench 4.0, a claim-level hallucination rate on a stress test that fell from 23.4% to 8.3%, and full weights due by November 4.

K3.1 Pro is the first model in a new K3.1 series. It has a 1-million-token context window and comes with a faster sibling, K3.1 Pro Highspeed, which Kimi says runs at 2-3× the speed of K3.1 Pro. Testing Catalog reported the model at 2.8T total parameters with 104B active. That is a mixture-of-experts design, where only part of the network runs for each token. Kimi’s own description is “3T-class”.

What changed from K3

The base model is the same. K3.1 Pro is K3 with “substantially larger post-training compute”, and K3 itself shipped on July 16, 2026, as the largest open-weights model at 2.8 trillion parameters. Kimi says it reworked the whole stack so it could run reinforcement learning jointly across hundreds of downstream domains. That covered the RL framework, long-context inference, training efficiency, sandbox infrastructure, rollout scheduling, and a shared platform for checking environment quality. The stated goal was for “each increment of RL compute” to deliver “stable, predictable returns”.

All of the before-and-after figures come from Kimi’s internal benchmarks:

• Kimi Code Bench 3.0 Long-horizon, which covers multi-step execution, tool use and end-to-end problem solving: 61.2% for K3.1 Pro against 55.95% for K3.
• Financial Modeling, which grades formula linkage, financial logic and final workbook quality: up 7.2 points over K3.
• Financial Research, which grades auditable research under evidence and cutoff constraints: up 11.6 points.
• Business Operation, which covers long-horizon management in a simulated business: about 4.2× K3’s performance.
• Kimi Hallu Bench Hard: the claim-level hallucination rate fell from 23.4% for K3 to 8.3%. The share of responses with at least one factual error came in at 42.4% of K3’s rate.

Kimi qualifies the hallucination result itself. It says the test is built from examples “deliberately crafted to probe situations where models are prone to errors”, and that the rates “do not represent overall error rates in daily use.”

Kimi backs the long-horizon coding claim with one worked case. K3.1 Pro built a human walking simulator on top of human-atlas, an open-source anatomical model with 296 skeletal and 402 muscle components. Over 167 missions and 420 independent reviews, the simulated body went from collapsing within seconds to walking with alternating strides for 11.2 seconds. Reward shaping did not fix the arm motion. So the model ran open-loop probes of the simulator’s dynamics, found 36 errors in the shoulder-muscle moment-arm calculations, corrected them and retrained the controller.

On the product side, Kimi says the model works across Unity, Unreal Engine and Godot. It can also write and run scripts for Blender and CAD software without MCP connectors. A new 3D Make feature on kimi.ai and the Kimi app exports models for 3D printing, or as videos and Live Photos.

Against the closed models

On Terminal-Bench 4.0, Kimi puts K3.1 Pro at 65.7%. That is just behind Claude Opus 5.5 at 66.4% and ahead of GPT-6 Astra at 58.2%. Kimi ran its own model in the Claude-Code harness. Unless otherwise specified, Kimi’s K3.1 Pro results use reasoning effort set to “max”, temperature 1.0 and top-p 0.95. In September, Sonnet 5.5 posted 70.6% on the same benchmark.

BenchCAD tests rebuilding a 3D object from multi-view renderings by generating CAD code. There K3.1 Pro scores 92.7% with tools, against 96.2% for Claude Opus 5.5 and 95.9% for GPT-6 Astra. Kimi claims a state-of-the-art 64.4 on OfficeQA Pro v2, a test of fiscal analysis over real financial documents that requires retrieval, cross-document checks and multi-step arithmetic. On Frontier Finance, which covers investment workflows from screening to profitability analysis, Kimi says only that K3.1 Pro improves over K3.

Testing Catalog described the model as performing on par with Opus 5.5 and GPT-6 Astra “while being significantly cheaper”.

The cyber cut

Kimi says vulnerability research performance kept climbing as post-training scaled. When it traced the source of that trend, it found cyber-related content mixed into the general mid-training corpus and cyber tasks in the RL environment mix. In preliminary experiments on internal models, skipping data removal at either stage led to a substantial rise in downstream cyber capability. For the open-weight K3.1 Pro, Kimi removed cyber-related data from both stages and kept the general-purpose coding tasks.

Kimi measured the effect on xdev-bench-hard, its in-house set of expert-curated exploitation tasks. Most tasks reproduce recently disclosed vulnerabilities in the Linux kernel, Node.js, JavaScriptCore, Exim and VirGL, with mitigations enabled. Each task gives the agent the vulnerable source code, a short bug hint and the binary. To pass, the agent has to achieve arbitrary code execution in a separate sandbox and retrieve a secret string. Kimi reports pass@3, where a task counts as solved if any of three attempts succeeds, over a random subset of runs with no hard timeouts or output token limits. Under those conditions, the checkpoint trained without any cyber filtering solves 90.5% and the released K3.1 Pro solves 81.0%, a 9.5-point gap from the same pipeline.

Kimi also says K3.1 Pro still improves substantially over its predecessor. It reads this as stronger general coding and long-horizon debugging carrying over to cyber tasks even after the targeted data removal. The company says K3.1 Pro’s cyber capability stays behind frontier proprietary models that have been publicly available for at least three months.

Kimi sets out two principles for open weights. The first: “we aim not to release open weights that would extend the absolute frontier of cyber capability.” The second is to raise the cyber capability available in open weights progressively. Its defensive argument is about auditing. When a capable model runs on infrastructure its users control, many more teams can review the code they maintain, “including legacy systems that rarely receive dedicated security reviews.”

Where to get it

K3 followed the same order: API first, weights later. A Hugging Face blog post recorded K3’s July 16 API release, a promise of full weights by July 27 and a license marked “TBD with weight release”.

K3.1 Pro is rolling out on Kimi.ai and the Kimi apps for iOS, Android and HarmonyOS. It is also in the Kimi Work desktop app, version 3.1.0 or later, on Windows and Apple silicon Macs. In Kimi Code, you pick it with the /model command. On the Kimi API Platform, the model IDs are kimi-k3.1-pro and kimi-k3.1-pro-highspeed, and Zero Data Retention is available for API customers.

On Kimi Enterprise, access is off by default at launch, and an administrator has to enable K3.1 Pro for the organization.