Ethereum co-founder Vitalik Buterin supports Moonshot AI’s choice to leave advanced offensive hacking material out of its Kimi K3.1 Pro model.
TL;DR
- He says restricting what a model can do is far better than restricting who may use it, and fears AI security failures could trigger identity checks and surveillance.
- Moonshot’s own tests show the filtered model solving 81% of exploit tasks versus 90.5% unfiltered; open weights are due by November 4.
- Those numbers are Moonshot’s and have not been independently verified.
Buterin Sides With Restraint
In an October 26 post on X, Buterin said he was comfortable with Kimi K3.1 deliberately leaving top-end offensive cyber capabilities out of its training data. His reasoning centers on time. The world, he argued, needs room to harden systems, re-examine old software and apply formal verification to new code before AI-driven attacks become routine.
Formal verification means mathematically checking that software meets its stated requirements, and Buterin has long promoted it as a way to catch weaknesses before deployment. In September he rejected the idea that AI hacking will make cybersecurity unwinnable, arguing automated verification can strengthen defenders.
He was not claiming the approach will stop anyone. Asked whether rival labs would build these capabilities regardless, he agreed that they will.
Inside Kimi K3.1 Pro
Moonshot, a Chinese startup, announced Kimi K3.1 Pro on October 23. It is already live in the company’s apps and API, and full model weights are scheduled for release by November 4. According to the company, developers stripped selected cyberattack-related data from both training and reinforcement learning while preserving general programming ability.
Moonshot reports a measurable trade-off on its internal exploit benchmark. A version without the restrictions completed 90.5% of tasks, against 81% for the shipped model, a gap of 9.5 percentage points. The company has not shown how that gap translates into real-world attack prevention. For context, the earlier Kimi K3 scored 33.3% on the same test.
On Terminal-Bench 4.0, the new model scored 65.7%. Moonshot lists 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. A Highspeed variant is said to run two to three times faster than the standard version. All of these results come from Moonshot’s own testing.
The KYC Warning
Buterin’s broader concern is political rather than technical. He suggested that governments and tech companies could respond to a serious AI-related incident by locking down models, requiring Know Your Customer checks, and expanding surveillance. Access to advanced tools might then hinge on nationality, documents or credentials, leaving some people as second-, third- or fourth-class users.
His own projects point the other way. On October 16, he introduced a privacy-focused AI agent setup that combines Tor routing, anonymous payments through zkAPI and local prompt rewriting, aiming to limit what outside models learn about the person using them.
Independent evaluators have already looked at Moonshot’s models. In July, the US Center for AI Standards and Innovation and the UK AI Security Institute tested Kimi K3 against simulated cyberattacks. It trailed leading systems yet could still attempt offensive operations despite safeguards. In one simulated corporate-network attack, it averaged 17 of 32 steps, compared with 28.5 for the strongest US models tested. That assessment covered K3, not K3.1 Pro.
The Bottom Line
The debate Buterin is joining pits capability limits against access controls, and he clearly prefers the former. Whether a 9.5-point drop on one internal benchmark counts as meaningful protection is still unproven, and the open-weight release will let outsiders probe it.