Just 0.7 Points Behind, Half the Price
65.7% vs 66.4%. Kimi’s newly released K3.1 Pro scored 65.7% on Terminal-Bench 4.0, leaving only a 0.7 percentage point gap behind Claude Opus 5.5, while GPT-6 Astra scored 58.2%. The official positioning for K3.1 Pro is “currently strongest 3T-class open-source weight model”—3 trillion parameters, 1 million token context window, joint reinforcement learning across hundreds of domains, and the first model in the K3.1 series, with weights scheduled for release on November 4, 2026.
Terminal-Bench evaluates long-range tasks in terminal environments: setting up environments, modifying configurations, running toolchains—where a single mistake in dozens of steps can cause the entire process to fail. These tasks best highlight the differences between agent models and most closely reflect developers’ daily work. The 1 million token context window is essential for long conversations and large codebases, making this score meaningful—context must fit, and tasks must complete.
The 0.7 percentage point difference falls within evaluation noise range. The official evaluation settings were inference level max, temperature 1.0, top-p 0.95, with numbers compared under the same conditions. Open-source weight models are now matching closed-source leaders in terminal long-range tasks.
Figure: Official release page capability overview. See Terminal-Bench 4.0 column: 65.7 vs 66.4, with the difference compressed within 1 point. Source: Kimi Official Blog
The match is partial. In BenchCAD with tools, K3.1 Pro scored 92.7, while Opus 5.5 scored 96.2 and GPT-6 Astra scored 95.9—placing it in the first tier for engineering tasks, still over 3 points behind the leader. OfficeQA Pro v2 achieved 64.4, which the official claims state-of-the-art (SOTA), with approximately 4.2x improvement over the previous generation for business operation tasks—improvements in document-intensive work directly correspond to usability in office automation scenarios. The hallucination rate dropped from 23.4% to 8.3% on Kimi Hallu Bench Hard, a reduction of about two-thirds; for teams using models for automated workflows, the hallucination rate is more practical than benchmark scores, as it determines whether outputs can be used directly.
The official also demonstrated a long-range scenario: arranging 296 bone components, 402 muscle components, and 167 total tasks in a human-atlas scenario, reducing human walking generation to 11.2 seconds. Teams running agents have likely seen task chains fall apart midway—forgetting constraints from step 10 at step 100, making the previous 99 steps useless. The key point of this demonstration is that the 167 tasks formed a single chain without breaking down.
Same 93 Points, 2.4x Price Difference
Beyond the close scores, the community is more concerned about pricing. A developer used the Pac-Man benchmark to run K3.1 Pro and Claude Sonnet 5.5 side by side: both scored 93 points, with K3.1 Pro taking 11 minutes and costing $0.68, while Sonnet 5.5 took 14 minutes and cost $1.61. With identical scores, the bill was 2.4x higher, and it took 3 minutes longer. *For teams running batch agent tasks on token-based pricing, this price difference multiplied by task volume is the entire reason to switch models.
Single task costs fluctuate, and one sample isn’t statistically significant, but the direction is clear: with identical scores, both time and cost axes are superior, allowing the same budget to handle 2.4x the task volume.
The Highspeed version offers more granular choices: officially claiming 2-3x speed. For high-frequency interactive users, every second waiting for the model is a net loss, making speed the priority; for overnight batch pipelines, speed doesn’t translate to money, making unit cost the priority. Having two speed tiers in the same series makes cost structure a product parameter, serving two different scenarios.
The Deleted 9.5 Points Are the Real Focus of This Release
The most significant section of this release isn’t in the capability rankings. The official explicitly states that offensive cyber capabilities data have been removed from training data and reinforcement learning processes, and what was removed had already passed their own risk review—passed inspection, but still chosen to be excluded, with “not doing” included in the release notes.
The cost is verifiable with public data. On the attack-leaning xdev-bench-hard, their own control version (without risk reduction) achieved 90.5%, DeepSeek scored 85.7%, K3.1 Pro came in at 81.0%, GLM-5.3 scored 57.1%, and the previous K3 only reached 33.3%. 81.0 vs 90.5—that 9.5 percentage point difference is the price tag for this self-imposed limitation: the model could have scored higher but was deliberately capped, and the magnitude of the reduction was made public. The distribution on this chart is widely scattered, with capability scores reflecting each company’s risk trade-offs, making rankings alone insufficient. The control version’s 90.5 score also answers another question: attack capabilities around the 90-point mark are achievable, and the release version is actively restraining them.
Figure: Official benchmark test details. Note the xdev-bench-hard row: official version 81.0, control version without risk reduction 90.5. Source: Kimi Official Blog
Closed-source vendors can block certain capabilities at the deployment layer with filters and policies; once weights are open source, what downloaders receive is the model itself, which can’t be recalled once released. *To control certain capabilities on the open-source path, the gate can only be installed at the training data end—post-release usage terms can’t control the weight files themselves.
Enterprise Default Disabled, Subscription Quotas Exceeded First
Usability is comprehensive: switch directly in Kimi Code with /model, APTI model names kimi-k3.1-pro and kimi-k3.1-pro-highspeed, available in Kimi Work desktop starting from v3.1.0. The APTI supports Zero Data Retention (ZDR), where the service provider doesn’t store request data—a key consideration for enterprises using private data.
On the enterprise side, Kimi Enterprise has this model disabled by default for enterprise customers. Controlling the model itself at the training data end and controlling usage scenarios at the product end with default disabled follow the same approach. *Default disabled is more direct than any wording in the release notes: capabilities can be written in promotional materials, but attack surface risks must be managed through default configurations and contract terms.
The subscription response wasn’t so polite. The $99/month plan received numerous complaints: one user reported a single session running for 47 minutes, exhausting their 5-hour quota. At this consumption rate, the actual cost for heavy users is far higher than the listed price, with the quota design accommodating computational costs.
On the other side of the discussion, focus is on the model’s personality: some say K3.1 is more direct and argumentative than US models, directly replying with “We’ve already discussed this three times, changing the question won’t change the answer.” For a programming agent that requires repeated iterations, not complying with user requests saves back-and-forth confirmation rounds. In the same discussions, others immediately ask “What are the main distillation sources?” For the same model, complainers are calculating costs, admirers are noting personality traits, and skeptics are questioning origins—all three are genuine feedback from this release.
The Next Competition: Who Dares to Publicly Say “Not Doing”
Looking at the release content: a 0.7 point gap, more than 50% price advantage, and a class of capabilities proactively removed from training data. The first two are standard fare in open-source model competition; the third was an optional action that wasn’t required, making it the truly new information in this release.
In the past, the open-source narrative only chased scores: whatever benchmark closed-source models appeared on, open-source models followed. K3.1 Pro brought another matter to the forefront—safety through subtraction at the training data stage, with comparative data showing how much that subtraction costs. *When capability gaps are compressed within 1 percentage point, the next metric distinguishing open-source from closed-source will be who dares to write “what we won’t do” as a data-backed promise.
This approach carries the unique attribute of open-source: verifiability. After the weights are released on November 4th, how much attack capability remains can be benchmarked by anyone. What downloaders will receive is a 65.7-point model without offensive cyber capabilities—the score will be surpassed by the next release, but this pre-stated “not doing” is what K3.1 Pro truly leaves behind.
Reference links:
- Kimi Official Release Blog
- HN Discussion
- Kimi Code Model Documentation
