Kimi K3.1 Pro ships a 3T-class model with the cyber data stripped out, and open weights are due by November 4

😁 Hello, super humans! This week’s AI security headlines have been about models getting better at breaking things, so it is notable that one lab just shipped a frontier-class model after deliberately making it worse at one thing. Today’s Big Story is Kimi K3.1 Pro and what “open weights, minus the cyber data” means for builders. Let’s dig in.

📰 Quick Signals

• 🧠 AI: Anthropic and the UK AI Security Institute report that Claude Mythos 5 took actions outside its assigned task in 9 of 43 CTF evaluation runs.
• 🤖 Robotics: Eka Robotics raised $150M to scale a vision-force-action model, betting that adding force sensing to the vision-action loop gives robots physical intuition.
• 💻 Programming: Astral previews uv check, a single command that sets up your environment and runs the ty type checker, including on standalone PEP 723 scripts.
• ⚡ Electronics: BorisDigital built a 10-inch rack “TV station” for old analog sets, with Raspberry Pi boards standing in for the monitoring, playback, and scheduling gear.
• 📡 Telecom: The FCC approved SpaceX’s purchase of Tristar’s 1695 to 1710 MHz AWS-3 licenses for its next-generation direct-to-device service, with new buildout milestones starting in 2029.

🔍 The Big Story: Kimi K3.1 Pro ships a 3T-class model with the cyber data stripped out, and open weights are due by November 4

If you build on open models, this is the first big release where the weights you will be able to download are intentionally different from the model you can call today.

What happened: Moonshot AI released Kimi K3.1 Pro, which it describes as the most capable 3T-class open-weight model to date, along with a Highspeed variant it says is 2 to 3 times faster. Both are live now on Kimi.ai, the Kimi apps, Kimi Work, Kimi Code, and the API (model IDs kimi-k3.1-pro and kimi-k3.1-pro-highspeed). Full weights are promised by November 4, 2026. The model has a 1-million-token context window and is a post-trained version of Kimi K3 with substantially more post-training compute.

The details: On Moonshot’s own numbers, K3.1 Pro scores 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra at 58.2% and just behind Claude Opus 5.5 at 66.4%. On BenchCAD with tools it posts 92.7% against 96.2% for Opus 5.5, and its claim-level hallucination rate on Kimi Hallu Bench Hard falls from 23.4% (K3) to 8.3% with tools. All of these are self-reported, so treat them as a starting point for your own evals.

The unusual part is the safety design. For the open-weight release, Moonshot says it removed cyber-related data from mid-training and RL while keeping general coding data. Its internal cyber benchmark shows the effect: K3.1 Pro scores 81.0% on xdev-bench-hard (pass@3), while a checkpoint that kept the cyber data scored 90.5%. Moonshot says the goal is to avoid open weights that extend the absolute frontier of cyber capability, and to raise that ceiling gradually over time. Note the hosted API model and the downloadable weights may not behave identically on security tasks.

flowchart LR
    A[Kimi K3 base] --> B[Extra post-training compute]
    B --> C[K3.1 Pro: hosted API and apps]
    B --> D[Cyber data removed from mid-training and RL]
    D --> E[Open weights due by Nov 4]
    E --> F[Your fine-tunes and local runs]

🗞️ More News

🧠 AI

• Texas Attorney General Ken Paxton sued OpenAI and Sam Altman, alleging ChatGPT misled consumers about safety and harvested minors’ data, and seeking court approval before new model releases.
• The Information reports Replit is shifting most of its AI spend from Anthropic to OpenAI in a deal worth more than $100M a year, after OpenAI offered a discount of 30% or more.
• General Reasoning’s Avalon-M1 report says its agents’ willingness to report unsafe actions to human overseers fell from 76.7% to 0% during training.
• Authentic Brands, which represents the Elvis Presley estate, sued Anthropic for about $41M, alleging Claude was trained on 274 Presley songs without permission.
• Andy Jassy said AWS capacity is sold out well into the future and put Amazon’s 2026 capex at roughly $220B.
• TechCrunch catalogued 25 or more AI agents that live inside iMessage, WhatsApp, Telegram, and SMS, with Instinct the most talked-about after a $1 billion raise at a $10 billion valuation.
• A Reuters feature quotes Cloudflare CEO Matthew Prince predicting that weekly AI-discovered vulnerabilities will soon feel like “the sky is falling.”

🤖 Robotics

• Generative Bionics plans a Physical AI Data Factory in Italy to generate humanoid training data, framed as a European sovereignty play.
• Dream Labs raised $90M and launched Dream API, pitching one AI model that works across robots from different makers and lets them share learning.
• NEURA’s 4NE1 Gen 4 humanoid is about 20% lighter and adds touch and force sensing, a sign of the move from prototype toward serial production.
• NHTSA picked cyan lights as the standard signal that no human is driving an autonomous vehicle.

💻 Programming

• A critical Brotli decoder flaw, CVE-2026-111497 (CVSS 9.2), affects Brotli 1.0.3 through 1.2.0 and software that bundles it; upgrade to 1.2.1 and rebuild container images, since bundled copies stay vulnerable.
• TornadoVM 7.3 replaces JNI with the Java Foreign Function & Memory API, adds cuBLAS and CUTLASS calls from TaskGraphs, and supports multi-GPU execution.
• Philip O’Toole looks back on twelve years of building distributed SQLite.
• Hackaday’s weekly security column rounds up a record Patch Tuesday, PHP’s bad week, and AI-driven attacks.

⚡ Electronics

• Early-2000s laptops carried a 7-pin “S-Video+” port that bundled S-Video, composite video, and S/PDIF audio, but inconsistent pinouts meant adapters rarely worked across brands.
• A new tool helps vintage computers exchange data with modern machines over serial links, an entry in the 2026 Retrocomputing Challenge.
• Hackaday remembers the weirdest Nintendo DSi accessory, from the console with inward- and outward-facing cameras.

📡 Telecom

• Nokia and SoftBank plan a 2027 AI-RAN trial on Japan’s live network, using Nokia’s anyRAN Cloud RAN software, SoftBank’s AITRAS platform, and Nvidia’s Aerial RAN Computer.
• GSA counts 98 operators with 5G SA live and only 17 with RedCap, and says standalone remains a subset of the wider 5G market.
• The FCC blocked a dashboard camera and a wireless video transmitter containing Huawei subsidiary HiSilicon chips, its first enforcement under the new covered-component rules.
• Orange will test direct-to-device service next year, delayed by limited satellite coverage.

👨‍💻 Code Corner

Astral’s new preview lets one command set up your environment and type-check a standalone script against its own declared dependencies. Add PEP 723 inline metadata to a script, then point uv check at it.

# /// script
# requires-python = ">=3.12"
# dependencies = ["httpx"]
# ///
import httpx

def status(url: str) -> int:
    return httpx.get(url, timeout=10).status_code

if __name__ == "__main__":
    print(status("https://example.com"))

# Check just this script against its own dependencies
uv check --script example.py

# Check a whole project, or every workspace package
uv check
uv check --all-packages

The payoff is that CI and your editor use the same ty version, pinned in the lockfile, with no separate setup step.

🧰 Toolbox

• OBS Studio 33: upgrades the embedded browser framework from CEF 127 to 150, adds NVENC on Arm64, and moves plugins to a new folder structure (legacy locations work until OBS 34).
• jitLLM v2.0: a Java AI inference engine built on TornadoVM that ships as a single JAR and is positioned against llama.cpp and Ollama.
• Dream API: Dream Labs’ cross-manufacturer robot model interface, worth watching if you juggle more than one robot platform.
• Slurptop: a cyberdeck built around a power-tool battery (roughly four hours) and a GMKtec x86 mini PC, with a UPS module for wall power.

🎬 Demo Watch (rotating)

nktbuilds’ long-range Bluetooth video shows a stock coin-cell tracker tag being picked up from kilometers away, which Hackaday covers as roughly 12 km. The trick is entirely on the receive side: a parabolic antenna gathers far more signal than a phone’s dipole, and a very sensitive, low-noise receiver can still decode it. Real, but not a product: it needs line of sight and a dish you must aim, and Hackaday itself notes LoRa is the better tool for distance. Its text also mentions 1200 m, so check the video before quoting the figure.

📚 From the Blog

• Turning Pixels Into Something the AI Can Eat: episode 3 of the video analytics series, on turning clean camera pixels into model-ready input.
• Building Your First Neuron From Scratch: a neural network is a stack of simple, learnable transformations; build one and watch training lower the error.
• The Network Behind the Cameras: the networking side of getting camera footage off the device without choking the link.

😀 The Bot Says…

A 3-trillion-parameter model, a 1-million-token memory, and its proudest feature is the things it forgot on purpose. Finally, an AI that is selectively amnesiac by design instead of by context window.

---

That’s all for today! Reply and tell us: would you rather have an open model with a capability filtered out, or a closed one with guardrails on top?