Kimi K3.1 Pro Biology Capabilities Assessment

Kimi K3.1 Pro Biology Capabilities Assessment

Moonshot’s newest model performs comparably to Kimi K3 on our biology capabilities evaluations, maintaining the gap behind closed-weight models.

Kimi K3.1 Pro, the latest model from Moonshot AI, is 2nd among open-weight models on our Bio Capabilities Index (BCI), and 19th overall. Its score of 149 places it just behind Kimi K3 (150) and well behind the highest-scoring model, Claude Opus 5 (177). With respect to safeguards, K3.1 Pro refuses only 33.6% of hazardous prompts in our BioTIER benchmark.

Kimi K3.1 Pro was released via Moonshot’s API on October 23, 2026, and Moonshot plans to publish its weights by November 4. This analysis includes results from our knowledge benchmarks and safeguard evaluations; agentic benchmark scores will follow on our dashboard.

Kimi K3.1 Pro’s biology capabilities are similar to Kimi K3’s, about a year behind the closed-weight frontier

On SecureBio's Bio Capabilities Index (BCI), which aggregates multiple biology benchmarks into a single comparable number, Kimi K3.1 Pro scores 149. That places it 2nd of the 36 open-weight models we’ve evaluated, just behind Kimi K3 (150), which was released in July, and tied with Alibaba’s Qwen3.8 (149). Among all evaluated models, K3.1 Pro is 19th, still substantially behind leading closed-weight models. The current top open-weight score was first passed by Google’s Gemini 3 Pro (156) in November 2025, about 11 months before K3.1 Pro’s release.

Figure 1. Frontier Bio Capabilities Index (BCI) scores against model publicrelease date. Kimi K3.1 Pro is just behind Kimi K3 at the open-weight frontier. The steps trace the highest-scoring closed-weight (solid) and open-weight (dashed) models available at each date. Kimi K3.1 Pro with its 95% confidence interval (144 to 156) is highlighted in blue. The BCI score aggregates performance across multiple biology benchmarks into a single comparable number, set so that Claude 3.5 Sonnet = 100 and GPT-4 = 70. BCI methodology details are available on the dashboard.

Kimi K3.1 Pro rarely refuses to answer hazardous biological questions

Our BioTIER benchmark measures whether models refuse hazardous biological queries and permit benign ones. K3.1 Pro refuses 33.6% of the questions in our BioTIER-refuse set and correctly permits 99.9% of our BioTIER-permit set. For hazardous refusals, this is a modest improvement from 26.9% for Kimi K3, but still far behind the classifiers and refusals of closed-weight providers. We test K3.1 Pro through Moonshot’s API, so our BioTIER numbers include production safeguards. Once the model weights are released, safeguards can likely be further removed by fine-tuning.

Figure 2. BioTIER-refuse and -permit benchmark scores. Kimi K3.1 Pro refuses few hazardous prompts and answers nearly all benign prompts. The x-axis (BioTIER-permit) is the share of benign prompts that a model answers; the y-axis (BioTIER-refuse) is the share of hazardous prompts that it declines.

Analysis of Moonshot’s safety information

Moonshot has not published a system card or safety report for Kimi K3.1 Pro, and its launch post does not discuss biological risk. Moonshot does conduct data filtering for cybersecurity, which it finds leads to a meaningful reduction in cyber capabilities, intentionally below the capabilities of frontier closed-weight models. Moonshot states that it aims “not to release open weights that would extend the absolute frontier of cyber capability.” This demonstrates that open-weight model providers can take steps towards withholding dual-use capabilities in released models.

Additional benchmark findings

Our knowledge benchmarks cover a wide range of biology and biosecurity-relevant topics. Kimi K3.1 Pro achieves the top open-weights score on two (VCT-v2 and MBCT) and improves on Kimi K3 on three of the four we highlight.

• Virology Capabilities Test (VCT-v2): 46.2 ± 1.2% (0.0% refused). K3.1 Pro places 8th overall on VCT-v2, up from 41.8% for Kimi K3 and the highest open-weight score, although far behind the frontier represented by GPT-6 Astra (58.0%).

• Molecular Biology Capabilities Test (MBCT): 60.7 ± 0.9% (0.0% refused). K3.1 Pro ranks 5th overall, about 3 points behind GPT-6 Astra (63.9%). It has the highest open-weight score, ahead of Kimi K3 (58.4%).

• World-Class Biology (WCB): 51.5 ± 1.6% (0.9% refused). K3.1 Pro ranks 27th, below Kimi K3 (55.0%).

• Human Pathogen Capabilities Test (HPCT): 63.5 ± 1.2% (0.0% refused). K3.1 Pro ranks 8th overall and 2nd among open-weight models, behind GLM 5.2 (65.3%).

Figure 3. Kimi K3.1 Pro scores across SecureBio benchmarks. Each point represents the mean of 10 runs; the line is the 95% confidence interval. Scores are refusal-adjusted, where refusals are excluded rather than marked incorrect. The columns at right show the percentage of questions each model refused. Models that refused more than half of the questions on a benchmark are excluded entirely. The bottom row of each panel is the mean score of the SecureBio expert panel on that benchmark, and the bar represents the 95% confidence interval.

Implications for open-weight biosecurity

Kimi K3.1 Pro does not move K3’s open-weight frontier forward on our BCI, remaining about a year behind the closed-weight frontier to date. Moonshot’s biological safeguards remain weak, with only a third of hazardous prompts being refused through the API. For an open-weight model, it is possible to remove model-level refusal and API-level classifiers, but these safeguards still increase barriers to accessing hazardous biological information.

Moonshot’s decision to withhold cyber capabilities for its open-weight release demonstrates that open-weight model developers can make good-faith attempts to limit specific hazardous capabilities.

We will continue to evaluate new models as they are released and expect to have results for K3.1 Pro on our agentic benchmarks in the coming weeks.

© 2026 SecureBio
1 Broadway, 13th Floor, Cambridge, MA 02142