Kimi K3.1 Pro 先发模型后发权重：100 万上下文、$2 输入价，以及一次刻意的「网安能力削减」

今天真正有什么，什么只是承诺

现在交付三样东西：Kimi.ai、Kimi Work 和 API 上的模型；一个速度快 2 到 3 倍、价格翻倍的 Highspeed 变体；以及一份文档，写着 1,048,576 token 上下文、始终开启的思考模式配合 reasoning_effort（low / high / max）、动态工具加载，以及带 5 分钟或 1 小时 TTL 的自动上下文缓存。使用需要至少充值 $1，累计充值额决定账号档位和并发、RPM、TPM、TPD 限制。

现在不交付的只有一样：权重。它被承诺在 11 月 4 日前。这个区别影响的是采购而不是工程。如果你想要开源权重是为了自托管、离线推理、或者摆脱厂商限流，那么在文件落到你自己控制的磁盘之前，这些好处一个都不存在；一个在你的评估窗口之后才落地的 checkpoint，和今天就能拿到的那个，是两个不同的候选。

API 这条路确实好测：端点兼容 OpenAI，第一个请求就是改个 base_url。陷阱在于其余全是默认值，而默认值是为别人选的。reasoning_effort 默认 max，这对一次困难重构是对的，对一小时分类一万张工单是错的。

# The API is OpenAI-compatible, which makes the first hour easy and the first
# week dangerous: you can swap a model name and never look at the defaults.
# Three defaults are worth pinning explicitly.

import os
from openai import OpenAI

client = OpenAI(api_key=os.environ["MOONSHOT_API_KEY"],
                base_url="https://api.moonshot.ai/v1")

resp = client.chat.completions.create(
    model="kimi-k3.1-pro",          # not kimi-k3; K3.1 is a different model
    reasoning_effort="high",        # low | high | max (default is max)
    max_tokens=4096,
    messages=[{"role": "user", "content": "Refactor this function and explain the diff."}],
)

print(resp.choices[0].message.content)
print("usage:", resp.usage)

# Thinking mode is always on for K3.1 Pro; reasoning_effort is the knob, and the
# default being max means an unbudgeted call spends more reasoning than you planned.
# Highspeed is a separate model id, kimi-k3.1-pro-highspeed, priced at 2x.

价格表里有一行大家会漏看

输入 $2.00 / 百万 token，输出 $10.00，缓存输入 $0.20。这组数字让模型看起来只有前沿闭源模型的一半价钱，冷调用里确实如此。被跳过的是缓存写入：5 分钟档 $2.00 / 百万，1 小时档 $4.00 / 百万。因为缓存是自动的、默认 TTL 是 5 分钟，一个有 20 分钟间隔的工作负载每次都要重新写一遍。

1 小时档不是在乱收费。它是「每份文档付一次」和「每轮都付一次」的区别，而在 $4.00 的写价对 $0.20 的读价之间，临界点很近：两次 1 小时档的读就胜过「一次写加一次读」的 5 分钟档。用你自己的间隔分布去算，别靠直觉。

还有一个会闷声咬人的缓存细节。缓存按块存储，不满一块的写不进去，按 miss 计费。如果你的共享前缀是一段散文、恰好在句子中间断掉，你会在那一小部分上永远付全价，而且从来收不到任何报错。

# Pricing per million tokens (official, K3 series, all with a 1,048,576 context):
#   kimi-k3.1-pro            input 2.00  output 10.00  cached-in 0.20
#                            5m cache write 2.00   1h cache write 4.00
#   kimi-k3.1-pro-highspeed  input 4.00  output 20.00  cached-in 0.20
#
# The cache write line is the part teams miss. Caching is automatic, TTL defaults
# to 5 minutes, and a 1h write costs double. Model both before you pick a TTL.

def cost(in_tok, out_tok, cached_in=0, cache_write=0, ttl="5m", highspeed=False):
    if highspeed:
        pin, pout, pwrite = 4.00, 20.00, 4.00 if ttl == "1h" else 4.00
    else:
        pin, pout, pwrite = 2.00, 10.00, 4.00 if ttl == "1h" else 2.00
    per = (in_tok * pin + out_tok * pout + cached_in * 0.20 + cache_write * pwrite) / 1_000_000
    return round(per, 4)

# An agent that re-sends a 120k-token repo slice each turn:
#   no cache:     120k in + 2k out  -> ~0.26 per turn
#   cached reads: 120k cached + 2k out -> ~0.044 per turn
print("cold", cost(120_000, 2_000))
print("warm", cost(0, 2_000, cached_in=120_000))
print("cold with 1h write", cost(120_000, 2_000, cache_write=120_000, ttl="1h"))

# Cache is stored in blocks: a partial block cannot be written and bills as a miss.
# Keep your prefix a round number of tokens rather than a prose paragraph that
# happens to end mid-sentence.

把基准数字放回上下文里

Terminal-Bench 4.0 用严格的、针对具体任务的测试来评估终端里的编码智能体。官方报告 K3.1 Pro 是 65.7%，高于 GPT-6 Astra 的 58.2%，略低于 Claude Opus 5.5 的 66.4%。在内部的 Kimi Code Bench 3.0 Long-horizon 上，报告 61.2%，K3 是 55.95%。这两个数字值得引用，也都来自厂商。

它能支撑的是一个「同一水平」的说法，而不是「领先」：一个调用价 $2 的模型，和那些你下载不到的模型坐在同一张桌子上。这是这次发布真正有意思的地方，也是最容易被过度解读的地方。Terminal-Bench 的分数取决于框架、重试策略和时间预算，别人框架上的 65.7% 在你这儿可能是 55%。

实际含义不是「换模型」，而是「做一次额外评估的成本已经便宜到，自己跑评估才是省钱的那个选项」。把框架搭一次、任务版本化，然后报「每个解决任务的成本」而不是百分比——因为贵五倍换两分，不叫收益。

# Vendor benchmarks rank models. Your eval set decides whether you can ship one.
# Run the same tasks through both models and report cost per solved task, because
# a model that scores 2 points higher at 5x the price is a different decision.

import json, subprocess, time

TASKS = json.load(open("tasks.json"))     # id -> {"prompt", "check_cmd"}

def run(model, task):
    t0 = time.perf_counter()
    out = subprocess.run(
        ["python", "agent.py", "--model", model, "--task", task["id"]],
        capture_output=True, text=True, timeout=1800,
    )
    elapsed = time.perf_counter() - t0
    solved = subprocess.run(task["check_cmd"], shell=True,
                            capture_output=True).returncode == 0
    return solved, elapsed, out.stdout.strip()

report = {}
for model in ["kimi-k3.1-pro", "your-incumbent-model"]:
    rows = [run(model, t) for t in TASKS]
    solved = sum(1 for s, _, _ in rows if s)
    report[model] = {
        "solved": solved,
        "total": len(TASKS),
        "mean_seconds": round(sum(e for _, e, _ in rows) / len(rows), 1),
        "cost_per_solved": "fill from usage logs, not from guesses",
    }
print(json.dumps(report, indent=2))

# Keep failed runs in the report. A benchmark that silently drops timeouts
# flatters whichever model gives up fastest.

缓存写入就是那一行，把一轮 $0.04 和一轮 $0.26 分开。

网安削减是设计选择，不是保证

Moonshot 做了一件大多数实验室说得很含糊、它却报得很精确的事。它发现中训练语料里的网安内容和 RL 环境里的网安任务都会抬高漏洞研究能力，于是从两个阶段都移除了网安相关数据，并在内部基准 xdev-bench-hard 上测结果——这个基准要求智能体开发漏洞利用、在独立沙箱里拿到代码执行、并取出一个密串。未过滤的 checkpoint 在 pass@3 下解出 90.5%，交付的 K3.1 Pro 是 81.0%。

这是实打实降了 9.5 个点，而且官方把原则说得很直白：它不打算释放会扩展网安能力绝对前沿的开源权重。两件事同时成立。这个下降是可测的，也是有意义的。同时它不是保证，因为任何人都能下载的权重可以被微调，而 81.0% 按任何历史标准都仍然是一个会写利用的智能体。

对团队来说，正确的反应既不是恐慌也不是无视，而是把任何有能力的本地模型当成「词汇量很好的不可信代码执行环境」：限制文件路径、限制出网、每一次拒绝都记录原因，并且别让模型碰任何揣着凭证的东西。这个姿态花一个下午，而且能扛过换模型——比围绕某一份 checkpoint 的分数写出来的政策耐用得多。

# The cyber question, as an engineering control rather than an opinion.
# Moonshot reports that removing cyber data took its internal xdev-bench-hard
# pass@3 score from 90.5% (an unfiltered checkpoint) to 81.0% for the shipped
# model. That is a real reduction and it is not the same as a guarantee, because
# anyone who downloads weights on November 4 can fine-tune them.
#
# So: assume the model is capable, and constrain what it is allowed to touch.

FORBIDDEN_PATHS = ("/etc/shadow", "/root", "~/.ssh", "~/.aws")
ALLOWED_EGRESS = {"api.moonshot.ai", "pypi.org", "files.pythonhosted.org"}

def screen_tool_call(name, args):
    if name == "shell":
        cmd = args.get("command", "")
        if any(p in cmd for p in FORBIDDEN_PATHS):
            return "deny", "credential path"
        if "curl " in cmd or "wget " in cmd:
            return "deny", "unexpected egress in shell"
    if name == "http_request":
        host = args.get("host", "")
        if host not in ALLOWED_EGRESS:
            return "deny", f"egress to {host}"
    return "allow", ""

# Log the decision and the reason for every denied call. The audit trail is the
# deliverable; the block itself is just the mechanism.

按两个日期做规划

第一个日期是 11 月 4 日，权重承诺日。第二个是一段时间区间：K2 系列在 2026 年 10 月 31 日之后不再对新注册用户开放，官方计划在 12 月底前退役全部 K2 模型。如果你还在 K2.7 Code 或 K2.6 上，你的迁移窗口就是这季度，迁移目标就是本文这个模型。

把模型标识钉在配置里而不是代码里，并且和评估结果放在同一个提交里。reasoning_effort 也要记下来——那种「查半天发现是默认值变了」的回归最烦人，因为 diff 里看起来没有任何可疑之处。

然后写清楚什么情况下你会切回去。一个兜底模型 id、一个成本上限、一个质量阈值，越线就结束实验。这句话是「评估」和「承诺」的分界线，而且在数字到来之前写要容易得多。

#!/usr/bin/env bash
# Pre-flight before you put a model with promised-but-unshipped weights in a
# production path.
set -euo pipefail

echo "== model id and variant =="
grep -R "kimi-k3" .env* config/ 2>/dev/null || echo "no pinned model id found"

echo "== reachable + reasoning default =="
python - <<'PY'
import os
from openai import OpenAI
c = OpenAI(api_key=os.environ["MOONSHOT_API_KEY"], base_url="https://api.moonshot.ai/v1")
r = c.chat.completions.create(model="kimi-k3.1-pro", reasoning_effort="low",
    max_tokens=64, messages=[{"role": "user", "content": "say ok"}])
print("ok:", r.choices[0].message.content[:40], "| usage:", r.usage.total_tokens)
PY

echo "== cache behaviour (5m vs 1h) =="
python - <<'PY'
print("reminder: TTL 5m is default; 1h writes cost 4.00/MTok, and partial blocks miss")
PY

echo "== weights date on the calendar =="
python - <<'PY'
from datetime import date
w = date(2026, 11, 4)
today = date.today()
print("weights promised by", w, "| days left", (w - today).days)
PY

echo "== K2 sunset =="
echo "no new K2 registrations after 2026-10-31; full K2 retirement by end of December 2026"

echo "== rollback =="
test -n "${FALLBACK_MODEL_ID:-}" || echo "no fallback pinned -> do not ship"

假定它有能力，然后限制爆炸半径：路径、出网、以及每次拒绝的审计记录。