Moonshot published the full weights of Kimi K3.1 Pro on Hugging Face this week, and the license shipped with them says more about where open-weights AI is heading than any benchmark on the model card.

The release

The release is 96 weight shards totaling roughly 1.56 TB, in MXFP4 quantization — a 4-bit format Moonshot trained the model in from the fine-tuning stage onward rather than compressing after the fact. The model is a 2.8-trillion-parameter mixture-of-experts with 104 billion parameters active per token, a one-million-token context window, and native text and image input, post-trained from Kimi K3 with joint reinforcement learning across hundreds of downstream domains. Running it locally takes serious infrastructure.

One subtraction matters as much as the additions: the cybersecurity training data was removed from the open weights. The model card’s numbers show what that did. On ExploitBench, K3.1 Pro scores 74.7 against 100 for GPT-6 Astra and 91.0 for Claude Opus 5.5; on ExploitGym the gap widens to 20.7 versus 42.4. Moonshot cut one capability from the weights while keeping it in the hosted API. That is a policy decision expressed as data curation, and it sets a precedent: the open weights and the commercial product are no longer the same artifact.

The benchmarks

Where does it land? Strong, with holes. On coding and agentic benchmarks it leads or ties the closed models in Moonshot’s comparison table: 65.7 on Terminal-Bench 4.0, 51.7 on SWE Marathon v1.1, 70.0 on HLE-Full with tools, 92.1 on BrowseComp, and an Elo of 1846 on GDPval-AA v2.1. GPQA-Diamond comes in at 94.2, essentially at parity.

The holes are real. On HLE-Diamond, K3.1 Pro scores 39.4 against 65.8 for GPT-6 Astra; on Program Bench it posts 31.5 against 65.0 for Claude Opus 5.5. The pattern reads as a model tuned hard for agentic work at some cost on the hardest reasoning sets. “Highest-scoring open-weights model” is defensible; “frontier parity across the board” is not.

The license

The weights ship under the Kimi K3.1 Pro License, a modified MIT license and a distinct document from the Kimi K3 license. The MIT core is generous: use, modify, fine-tune, distribute, sell. Three conditions do the rest of the work.

Section 2 defines “Model as a Service” — giving a third party access to inference or fine-tuning where that party controls inputs, parameters, or training data — and requires anyone operating a MaaS business with more than $20 million in aggregate revenue over any consecutive 12 months, counting affiliates, to sign a separate agreement with Moonshot before commercial use.

Section 3 is the attribution clause: if the model or a derivative runs in a commercial product with more than 100 million monthly active users or more than $20 million in monthly revenue, “Kimi K3.1-Pro” must be prominently displayed on that product’s user interface.

Section 4 exempts internal use — anything that doesn’t expose the model or its outputs to third parties — and use through Moonshot’s official products or certified inference partners.

The questions

What does attribution mean for a small use case? If you fine-tune K3.1 Pro into an internal tool, or embed it in a product with a few thousand users, Section 3 never triggers. Your obligation is the ordinary MIT notice in copies of the weights, and your users see nothing. The attribution duty is a threshold duty, and the thresholds are set high: 100 million MAU is Instagram-tier scale. But read the clause twice before relaxing. Section 2 counts affiliates in the revenue test; Section 3’s text doesn’t mention affiliates at all. Does a product inside a subsidiary get measured on its own MAU or the parent group’s? The license doesn’t say. Derivative works are explicitly covered, so your fine-tune inherits the obligation — and the day your product crosses the threshold, the notice appears in a UI nobody planned for it.

How is any of this enforced? This is the question I keep coming back to. There is no signature, no click-through, no registration. You “agree” by downloading weights from a public repository. Enforcement, if it ever comes, runs through copyright law — Moonshot owns the weights, and a license violation is an infringement claim in waiting. But consider the mechanics: how would Moonshot detect that a MaaS business crossed $20 million in trailing revenue? How would it establish which product crossed 100 million MAU? For Section 2, the money is visible eventually — companies at that scale have funding rounds and enterprise sales. For Section 3, attribution is an honor system until someone notices a missing logo on a homepage. Compare Llama’s license, which carried comparable conditions and which Meta has never been publicly reported to enforce. The conditions may matter less as law than as friction: a company with a real legal department reads Section 2 and picks Qwen, or picks the API instead of the weights, without anything going to court.

That may be the design. Moonshot gives away 1.56 TB of weights, keeps the enterprise deals behind a contract, and sets thresholds generous enough that almost nobody has to think about them — while every company that does think about them knows exactly where the line is. Read the license before you deploy. It’s the most interesting file in the repository.