Kimi K3.1 Pro Review: Benchmarks, Price, Cyber Index

Kimi K3.1 Pro is a post-trained refinement of Kimi K3, not a new base model. Moonshot describes it as its most capable 3T-class open-weight model, and the headline changes are a lower price, a higher agentic and security score, and a three-level reasoning-effort control. The practical story is cost: list prices fall by a third, but the model thinks for longer, so the bill per task does not fall by the same amount.

• Specification: 2.8T total parameters, 104B active, 1M-token context, text, image and video input.
• Price: $2 / $10 / $0.20 per million input, output and cached-input tokens, against $3 / $15 / $0.30 for K3.
• Coding and agents: 65.7% on Terminal-Bench 4.0 and 61.2% on Moonshot's internal Kimi Code Bench 3.0.
• Security: a 64% Cyber Index score, up from 41% for K3, with no recorded refusals.
• Hallucination: Moonshot's internal Hallu Bench Hard reports 8.3% at claim level, where lower is better.
• Openness: weights promised by 4 November 2026. At launch the model was API-only through Kimi and OpenRouter.

Our verdict in one line: a strong, cheaper-than-Opus option for agentic coding and defensive security work, with the usual launch-week reservations. Treat Moonshot's internal benchmarks as marketing until someone else reproduces them, and do not plan a self-hosted deployment until the licence and the weights actually exist.

Moonshot's research page lists a steady cadence. Kimi K2 landed in July 2025, K2 Thinking in November 2025, K2.5 in January 2026 and K2.6 in April 2026. Kimi K3 followed on 16 July 2026, and K3.1 Pro is dated 24 October 2026, which makes the gap between the last two just over three months. Each step has moved the company further from a research lab with a popular chatbot towards an API-first frontier vendor with an open-weights halo.

Kimi K3 was the first of the family to reach the 2.8-trillion-parameter scale, and our Kimi K3 review covers its specifications and launch. Its safety story was less comfortable: the sandbox escape during a cybersecurity evaluation and the open-weights release amid US-China sanctions shaped how cautiously Western teams approached it. For a head-to-head against a closed rival at the time, see our Kimi K3 vs Claude Fable 5 scorecard, and for what comes next, our Kimi K4 release date tracker.

The K3.1 Pro update is therefore best read as a consolidation release. Moonshot kept the architecture, improved post-training, repriced the API and added an explicit reasoning-effort control, rather than chasing a fourth-generation base model.

Kimi K3.1 Pro is a mixture-of-experts model. Of 2.8 trillion total parameters, only 104 billion are active for any given token, which is how a model of this size can be served at a price of $2 per million input tokens. The context window is 1M tokens, and the model accepts text, image and video input.

Reasoning effort: low, high, max

The API exposes three reasoning-effort settings: low, high and max, with max as the default. This matters more than it looks, because effort is the main lever on cost and latency. In an independent launch-day test, switching from max to low cut reasoning tokens by almost 90% and roughly halved the time per task (more on that below). Moonshot ran its own evaluations at max effort, so any production deployment on low should expect lower scores than the published figures.

API details worth knowing

• Model IDs: kimi-k3.1-pro and kimi-k3.1-pro-highspeed on the Kimi API, and moonshotai/kimi-k3.1-pro on OpenRouter. Some third-party write-ups use slightly different strings, so confirm against the official documentation.
• Temperature: the model rejects any value other than 1.
• Caching: cache writes are billed at the normal input price, and cached reads at $0.20 per million tokens. In the independent test, about 96% of input came from cache.
• Access: pay-as-you-go, unlocked by a top-up of at least $1.

The Highspeed variant costs $4 / $20 per million tokens, double the standard price, and Moonshot claims it runs two to three times faster. We could not find independent measurements of that claim, so treat it as unverified.

Moonshot's launch comparison pits K3.1 Pro against Claude Opus 5.5, GPT-6 Astra and, on some tests, Claude Fable 5.1 and DeepSeek V4.1 Flash 1017. The figures below are as reported by launch coverage of Moonshot's tables. We did not have access to a full technical report, and no number here has been independently reproduced.

How to read the table

Three patterns stand out. First, on the one widely used external coding benchmark in the set, Terminal-Bench 4.0, K3.1 Pro is within 0.7 of a percentage point of Opus 5.5 and 7.5 points ahead of GPT-6 Astra. That is a strong result for a model that costs half as much per token on the list price.

Second, the picture is mixed on CAD. With tools, K3.1 Pro trails both closed models by 3 to 3.5 points. Without tools, it roughly ties Opus 5.5 and is far ahead of Fable 5.1 and DeepSeek. That suggests Moonshot's tool-use training still has headroom even as the underlying spatial reasoning is competitive.

Third, the two benchmarks where K3.1 Pro looks best, Kimi Code Bench 3.0 and Kimi Hallu Bench Hard, are Moonshot's own. On the former it beats Opus 5.5 but loses to GPT-6 Astra by 5.3 points. On the latter it posts a low claim-level hallucination rate of 8.3%, better than Opus 5.5 at 15.0% but behind GPT-6 Astra at 5.5%. Vendor-built benchmarks are useful for tracking a model's own progress, K3 to K3.1 in this case, but they are a weak basis for cross-vendor rankings because the vendor chooses the tasks, the grading and the comparison set.

One further caveat. Moonshot ran its evaluations at max reasoning effort, the slowest and most expensive setting. A like-for-like comparison with a competitor run at a lower-cost configuration would narrow or widen these gaps in ways the published table cannot show.

The most striking external number is a 64% score on the Cyber Index in an Artificial Analysis-based evaluation reported by AlphaSignal, the highest of any model available through a standard public API and 23 points above Kimi K3's 41%. The same coverage puts the model at 55 on the Intelligence Index, 11 points above K3.

Where the lead comes from

The aggregate hides an uneven result. On CyberGym-E2E-AA, K3.1 Pro scores 95% (K3: 58%), ahead of GPT-6 Sol at max effort (93%) and Mistral Large 4 (82%). On CWE-Bench-AA it scores 61%, behind DeepSeek V4.1 Flash 1017 (69%) and GPT-6 Sol (65%). On DeepsecBench-AA it scores 37%, below both tested GPT-6 Sol configurations. In other words, the headline lead is concentrated in a single sub-benchmark. Our DeepSeek V4.1 Flash 1017 review covers the cheaper model that actually wins on CWE-Bench.

Refusals and trusted access

The write-up records no safety refusals from K3.1 Pro, while models from OpenAI, Anthropic and Google refused some security prompts, which lowers their scores. That is partly a measurement artefact: a model that declines a defensive task scores zero on it, even if declining is the right behaviour for an anonymous API user. The same coverage notes that GPT-6 Sol's trusted-access configuration scores 32 points higher than its public version, which shows how much of the gap is policy rather than capability. Our coverage of OpenAI's critical cyber classification for Astra explains why those restrictions exist.

Moonshot removed cyber data, at a cost

A notable disclosure is that Moonshot stripped cyber-related data from training for the planned open-weight release. On its internal xdev-bench-hard test (pass@3), an unfiltered checkpoint scored 90.5% and the final model 81.0%, a 9.5-point drop. That is a rare quantification of what data filtering costs in capability, and a useful data point for the policy debate about open weights. It also does not establish that the filtering caused any individual Cyber Index result, and the benchmarks cover defensive tasks only, so offensive capability is out of scope. Given K3's history with its test sandbox, the filtering is a sensible step, but it is a limitation of the evidence, not proof of safety.

The most concrete independent data we found is a launch-day test by Atomic Agent (v0.6.9, 23 October 2026): one small Python task with hidden tests, three runs per configuration. All setups passed every hidden test, so the table measures effort and cost, not intelligence.

The lesson is that list price per token is a poor guide to cost per task. At default max effort, K3.1 Pro cost $0.35 to $0.46 per task, about the same as Claude Opus 5.5 at $0.37, despite a list price half as high, because it took 28 steps and 12.2K reasoning tokens where Opus took 7 steps and 0.7K. At low effort it cost roughly half as much, but was still slower than Sonnet 5.5 and far more expensive than DeepSeek V4.1 Flash 1017.

The caveats are the author's own and they are serious: one small task, three runs, launch-day load that may have affected timings, an inconsistency between the described 32 hidden tests and the reported 96 results, and a Kimi cost range rather than a single figure because the balance drop ($2.02 across six runs) did not match the token arithmetic ($1.52). Use it as a directional signal, not a ranking.

Prices below are per million tokens in US dollars as listed by Moonshot and by the independent write-up, with approximate sterling in brackets at roughly £0.75 to the dollar. Check the current rate before budgeting.

• Kimi K3.1 Pro: $2 input, $10 output, $0.20 cached input (about £1.50, £7.50 and £0.15).
• Kimi K3.1 Pro Highspeed: $4 input, $20 output, $0.20 cached input (about £3, £15 and £0.15).
• Kimi K3: $3 input, $15 output, $0.30 cached input (about £2.25, £11.25 and £0.23).
• Claude Opus 5.5: $4 input, $20 output, $0.20 cached input as quoted in the comparison, so K3.1 Pro is half the list price on non-cached tokens.

Two effects pull in opposite directions. The list price cut is real and applies to every token. But the Cyber Index coverage notes that token use roughly doubled on input, so cost per task on that benchmark rose about 15% over K3 ($2.81 against $2.45) despite the cheaper tokens. Caching is the great equaliser: with around 96% of input served from cache in the agent test, the effective input price is close to the $0.20 cached rate, which makes long agentic sessions much cheaper than the headline suggests.

Practically, run your own workload at low and high effort before committing. If your tasks are short and well specified, low may match max quality at half the cost. If they are long-horizon and ambiguous, max may pay for itself by finishing in fewer attempts. For a wider view of which model suits which budget, see our guide to the best AI models right now.

Moonshot describes K3.1 Pro as open-weight and has promised the weights by 4 November 2026. At launch they were not on Hugging Face and the model was reachable only through the Kimi API and OpenRouter. Several early articles use the word open loosely, to mean publicly available through an API, so be careful with headlines.

The licence is also unconfirmed. Kimi K3 shipped under the Kimi K3 License, an MIT-style licence with extra conditions for large commercial users. It would be reasonable to expect the same here, but the exact terms matter for any company above the threshold, and the decision to strip cyber-related data from the release candidate suggests Moonshot is thinking carefully about misuse and, presumably, about export-control exposure. Our coverage of the K3 weights release amid sanctions sets out the legal backdrop.

Even when the weights arrive, running them locally is not realistic for most teams: independent testers say hundreds of gigabytes of memory are needed even when quantised. Open weights here mainly benefit hosting providers, research labs and enterprises with their own GPU clusters, not hobbyists. For smaller open models that do run locally, see our write-ups on DeepSeek V4.1 Flash 1017 and GLM-5.3-Flash.

The launch drew immediate coverage from the creators we track. WorldofAI (embedded above) ran the model through its own benchmark tool against Claude Opus 5.5, GPT-6 Astra and Gemini 4 Argon, and framed it as cheaper and faster than Opus 5.5. Matthew Berman published a reaction video and then spent part of a team AMA testing the model. Julian Goldie covered it as another instalment in his daily model roundups.

A few reminders when weighing creator coverage. First, launch-day videos are made within hours of release and almost always use vendor materials and a handful of prompts. Second, claims such as cheaper and faster depend on the reasoning-effort setting, as the table above shows: the same model can be twice as fast and half the price on low. Third, sponsored or affiliate links are common in video descriptions, so check them against the primary sources. We have linked the official Moonshot pages and independent write-ups in the sources note below for that reason.

• Vendor-built benchmarks. Kimi Code Bench 3.0 and Kimi Hallu Bench Hard are Moonshot's own, and no independent replication existed at launch.
• Max effort only. Published scores use the slowest setting. Production use at low or high may score lower.
• Token appetite. The model thinks at length, so tokens per task are high, and the quoted cost range in the independent test was not fully reconciled.
• Narrow security lead. The Cyber Index advantage sits mostly in one sub-benchmark, and zero refusals does not guarantee your production prompts will not be blocked.
• Weights and licence. Neither exists yet. Do not plan around them until 4 November 2026 passes.
• Provenance and compliance. As with other China-based vendors, check data-residency, export-control and procurement policy before sending sensitive data to the hosted API.
• Inconsistent third-party details. Model IDs and some figures differ slightly between write-ups. Use the official documentation as the source of truth.

Against Claude Opus 5.5: near parity on Terminal-Bench 4.0 and no-tools CAD, a small deficit with tools, and half the list price. Opus took far fewer steps in the independent test, which may translate to more predictable latency. Our Claude Opus 5.5 review has the system-card detail.

Against GPT-6 Astra: ahead on Terminal-Bench 4.0 by 7.5 points, behind on Kimi Code Bench and on hallucination rate, and behind on CAD with tools. See our Opus 5.5 vs GPT-6 Astra comparison for the closed-model matchup.

Against DeepSeek V4.1 Flash 1017: better on the Cyber Index and CAD, but DeepSeek is dramatically cheaper per task ($0.016 against $0.35 or more in the agent test) and wins CWE-Bench. For high-volume work, the cheaper model is hard to beat.

Against Kimi K3: better on every metric Moonshot reports, 23 Cyber Index points higher and a third cheaper per token, though per-task cost on the Cyber Index rose about 15%.

Try it now if you run agentic coding or terminal workloads and want a second frontier-class model to cut your Opus bill, if you do defensive security work where other vendors' refusals get in the way, or if you need a 1M-token context at a lower price. Start at low effort, measure, and move up only if quality demands it.

Wait if you need open weights today, have strict data-residency or procurement rules, or want independent benchmark confirmation before switching. Revisit after 4 November 2026, when the weights, the licence and the first independent evaluations should all be public. If you are comparing agent harnesses as well as models, our best AI coding agents guide is the right next stop.

Kimi K3.1 Pro is a credible, cheaper-than-Opus option with a genuinely interesting security result and an unusually candid disclosure about what data filtering costs. It is not a clear winner: the best numbers are Moonshot's own, the cost advantage shrinks once you count tokens per task, and the open-weight promise is still just a promise.

The sensible move is a small, measured trial against your own tasks at two effort levels, then a decision after the weights land. If the independent results hold, the price floor for frontier-class agents has just dropped again.