Key Highlights:
- Vitalik Buterin backed Moonshot AI’s decision to exclude advanced offensive cyber capabilities from Kimi K3.1 Pro’s training context.
- Moonshot reportedly decreased the model’s internal exploit score from 90.5% to 81% by removing cyber-related training data.
- Buterin warned that mismanaging AI risks could lead to locked-down models, mandatory KYC checks, and intrusive surveillance.
Ethereum co-founder Vitalik Buterin has supported Moonshot AI’s decision to restrict the offensive cyber capabilities of its latest model, Kimi K3.1 Pro. He argues that constraining dangerous use cases is better than restricting access based on an individual’s identity. Released on October 23, the model has a one-million-token context window, multimodal capabilities, and a reported 65.7% score on Terminal-Bench 4.0. Moonshot reportedly removed cyber-related training information to decrease the model’s offensive capabilities.
It simultaneously lowered its internal exploit score from 90.5% to 81%. Buterin’s response highlights an escalating discussion in AI development: how firms can restrict the potential for cyberattacks in developing systems without barring legitimate users or imposing access controls.
Why Did Vitalik Buterin Support Moonshot AI’s Decision?
Buterin shared his position on X, saying he was comfortable with Kimi K3.1 Pro deliberately excluding top-end offensive cyber capabilities from its training data. He argued that limiting certain AI applications is far less problematic than discriminating against users based on their identity, credentials, or nationality.
I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data.
Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old code, (properly) formally verify new code, etc before the full weight of very powerful cyber attacks is upon us.
And if this first big wave of AI risk is not handled well, then we may well get a dystopia of highly locked down models, KYC gating on everything, highly intrusive surveillance on everything, a society where you may be a second or third or fourth-class citizen in terms of model access based on your credentials and nationality.
— vitalik.eth (@VitalikButerin) October 26, 2026
“I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data,” Buterin wrote. His comment centers on the distinction between restricting what an AI model can do and limiting who can use it. By reducing capabilities that could enable sophisticated cyberattacks, developers may address specific risks without imposing broader restrictions that affect legitimate applications.
Buterin also argued that society needs more time to brace for advanced AI systems. He pointed to the need to strengthen current software, examine legacy code and use formal verification methods to improve the dependability of newly developed systems before advanced AI capabilities make cyberattacks difficult to manage.
The concern is that increasingly capable AI tools could make it easier to identify vulnerabilities and exploit software weaknesses. Preparing existing systems and improving safety practices could help firms reduce their exposure before such capabilities become more prevalent. Moonshot’s reported decision to remove cyber-related training data reflects one possible approach to this drawback. Rather than eliminating access to the model, the company sought to reduce specific offensive capabilities while retaining its usefulness for other tasks.
How Could AI Safety Measures Affect Access to Models?
Buterin also advised that an unsuccessful response to early AI risks could lead to a future in which access to models becomes increasingly limited. He warned against a scenario with highly locked-down systems, know-your-customer (KYC) requirements for broad categories of access, and intrusive surveillance.
In his view, the consequences could extend beyond cybersecurity. If developers and administrations respond to AI risks through restrictive access policies, people could receive different levels of access based on their credentials, nationality or other traits. Buterin described the probability of people becoming second, third or fourth-class citizens in terms of model access. His advisory emphasizes a wider concern about how safety measures are designed and implemented as AI systems become more capable.
Moonshot’s technical approach also raises questions about how developers should evaluate the trade-off between capability and risk. Removing cyber-related training data reduced Kimi K3.1 Pro’s internal exploit score from 90.5% to 81%. The decrease suggests that the changes affected performance on the company’s internal exploit evaluation, although the figures alone do not establish how the model would perform across real-world cyber scenarios.
The model’s reported performance on Terminal Bench 4.0 and its multimodal capabilities also demonstrate the distinction between general technical competence and potentially harmful specialised capabilities. A model can remain useful for legitimate development tasks while being created to avoid supporting certain offensive applications. Developers have reportedly welcomed Kimi K3.1 Pro for legitimate technical uses, including rooting an Amazon Fire TV device. Such examples demonstrate why restricting dangerous capabilities does not necessarily require preventing all advanced technical work.
The broader drawback for AI developers is to find guardrails that decrease the risk of harmful use without unnecessarily constraining genuine applications. Buterin’s remarks support a capability-focused approach, in which developers target specific risks rather than imposing sweeping restrictions on users.
As AI systems become more capable, the effectiveness of these measures will rely on how well they decrease harmful behaviour while preserving useful functionality. Moonshot’s decision and Buterin’s response add to the debate over whether targeted technical safeguards can provide a more suitable path between unrestricted AI capabilities and increasingly restrictive AI policies.
