Moonshot Just Dumped a 2.8T-Parameter Model on Hugging Face. Your GPU Is Crying.

Let’s get one thing straight immediately: when Moonshot AI said they’d release Kimi K3.1 Pro’s weights by November 4th, nobody believed they’d actually ship the full 2.8-trillion-parameter beast. The “open-weight” category has become a dumping ground for watered-down distillations and hobbled variants. Labs love the PR bump of saying “open source” while keeping the actual frontier model behind a paywall.

Moonshot didn’t do that. They dropped the real thing. And the AI world is still picking its jaw up off the floor.

The numbers are frankly absurd on paper: 2.8T total parameters in a Mixture-of-Experts architecture with 104B active, a 1,048,576-token context window, and a price tag that undercuts every frontier competitor at $2.00 per 1M input and $10.00 per 1M output tokens. Developer forums are buzzing with a mix of excitement and existential dread. One commenter’s take captured the mood: a 3T model with a license that fully permits personal use and only requires attribution for commercial use, unless you’re an API provider, in open weights is “absolutely wild.”

But wild doesn’t mean practical. Let’s dig into what actually landed on Hugging Face and what it means for everyone from indie developers to enterprise architects.

The 1.56 TB Elephant in the Room

Here’s where things get interesting. For eleven days between the API launch and the weight drop, most coverage quoted 5.6 terabytes of BF16 weights. The repository that actually appeared on Hugging Face is 1.56 TB across 96 safetensors shards. That’s not a smaller model, it’s the same 2.8T-parameter MoE, shipped in MXFP4 weights with MXFP8 activations, applied through quantization-aware training.

This isn’t a post-hoc 4-bit quant someone ran after the fact. It’s the native serving precision, which is why the repository carries the compressed-tensors tag and why there’s no BF16 checkpoint sitting beside it. If you were planning around a 5.6 TB download, you were planning against a number Moonshot never shipped.

The spec sheet tells the real story:

Only one of those numbers is new relative to Kimi K3, and it’s the attention change. Moonshot replaced the full-attention Gated MLA layers with Gated DeepSeek Sparse Attention (Gated DSA) layers for more efficient long-context modeling. This is a post-training release on the K3 base with heavier joint reinforcement learning across hundreds of domains, not a new architecture. The Gated DSA substitution is there for efficiency, not capability.

Now, about actually running this thing. The vLLM recipe specifies vLLM 0.34.0 or newer, with a baseline of one tensor-parallel group of 8 GPUs, two GB300 trays or one B300 node. The optional long-context mode, DCP8, raises KV cache capacity to roughly 18.5 million tokens against 2.6 million with FP8 KV on 8 B300s.

Here’s the brutal reality: an 8×H200 node is out because 1.13 TB of HBM can’t hold 1.56 TB of weights before you allocate a single token of cache. There is no consumer path. The model needs more VRAM than a workstation has, and the architectures that could make a slow CPU-offload version tolerable are still catching up with the custom kimi_k31 code, the repo ships trust_remote_code=True in its own quickstart, which tells you the architecture isn’t yet in a released upstream library’s default path.

As one commenter put it, “personal” use of a model that a $60K server can’t handle is a rather limited scenario. But another pushed back: the fact that they gave it away for free, that it’s even an option, is what matters. This will help squeeze the tech into a 27B model in 10-12 months.

That’s the real play here.

The License That’s Not Quite Open Source

The Kimi K3.1-Pro License opens the way you’d expect a permissive license to open: permission to use, copy, modify, merge, publish, distribute, sublicense and sell, to run, deploy and fine-tune, and to create derivative works. Then it adds conditions, and the conditions are where the decisions live.

Section 2 is the model-as-a-service gate. If you or your affiliates run a business giving third parties access to inference or fine-tuning, and group revenue exceeds $20 million over any consecutive 12 months, you need a separate agreement with Moonshot before commercial use. Two carve-outs matter: end-user products where the model is embedded inside a feature aren’t “model as a service”, and neither is merely relaying requests to models hosted by someone else.

Section 3 covers attribution. Commercial products with more than 100 million monthly active users, or more than $20 million in monthly revenue, must display “Kimi K3.1-Pro” prominently in the interface. That’s a branding obligation, not a payment.

Section 4 is the exemption clause. Neither of the above applies to internal use, defined as any use that doesn’t make the software, its outputs or its underlying capabilities available to third parties, or to use through Moonshot’s official products and certified inference partners.

The practical reading: internal deployments are free and unrestricted, and so is building a product on top of the model for your own users. What triggers the $20 million conversation is reselling raw model access at scale. If you were hoping to stand up a competing inference endpoint on these weights, that’s the paragraph to take to a lawyer. It’s structurally the same license Kimi K3 shipped under, so an existing legal review of K3 transfers with the name changed.

One thing the license doesn’t do is make this open source in the OSI sense. The field in the repository metadata reads license: other, with the license name set to kimi-k3.1-pro. Outlets that described it as modified MIT in the first hours after the drop were reading the permissive opening and stopping there.

This isn’t the only recent release with strings attached. The broader pattern of open-weight models with usage restrictions raises questions about what “open” really means, and the gap between the best open model and the best proprietary one has been steadily shrinking. The question isn’t whether you can download Kimi K3.1 Pro, it’s whether you can actually use it for what you need.

The Scoreboard Cuts Both Ways

Every figure in this section is vendor-reported from the model card, run at reasoning effort max with temperature 1.0 and top-p 0.95. The comparison columns are also taken at max effort with fallback enabled, which is worth knowing before you read a one-point gap as a win.

The “Ahead” column is genuinely impressive:

• Terminal-Bench 4.0: 65.7% vs 58.2% for GPT-6 Astra (though narrowly behind Claude Opus 5.5 at 66.4%)
• SWE Marathon v1.1: 51.7% vs 46.3% for Claude Opus 5.5
• BrowseComp: 92.1% vs 91.5% for GPT-6 Astra
• DeepSWE v1.1: 75.5%, beating everything including DeepSeek-V4.1-Flash-1017 at 77.0%? No wait, DeepSeek scores 77.0, so K3.1 Pro trails there. The scoreboard is more nuanced than the headline numbers suggest.

The “Behind” column is where things get uncomfortable:

• Program Bench: 31.5% vs 65.0% for Claude Opus 5.5. This is the widest loss on the sheet by a distance.
• Terminal-Bench-Science 0.1: 38.1% vs 68.1% for GPT-6 Astra
• HLE-Full without tools: 51.1% vs 59.8% for Claude Opus 5.5

The pattern is consistent enough to be useful: Kimi K3.1 Pro is strong where an agent is driving a shell, a browser, or a long-running coding task, and weak on self-contained scientific and program-construction benchmarks. If you’re choosing between it and Claude Opus 5.5 based on a single headline number, the headline number is the one place they’re closest.

Independent measurement is thin and worth stating plainly. Artificial Analysis currently scores Kimi K3.1 Pro at 46 on Intelligence Index v5.0.1 and lists it as open weights, at 32 output tokens per second, ranked first of 25 on the panel shown on its model page. Launch-week coverage quoted 55, but that was against the index build in use before the v5 rebuild on October 27, different instruments, and subtracting one from the other produces a number that means nothing.

On BenchCAD, the 3D reconstruction benchmark, Kimi K3.1 Pro scores 92.7% with tools, approaching Claude Opus 5.5 at 96.2% and GPT-6 Astra at 95.9%. Without tools, the scores drop dramatically: Claude Opus 5.5 at 73.0, Kimi at 72.8, and Claude Fable 5.1 at 60.6. The gap between with-tools and without-tools performance across all models shows how much harness quality matters in these evaluations.

For the coding benchmarks specifically, K3.1 Pro was evaluated with the Claude Code harness in many cases, which raises questions about whether the results would hold with other harnesses. The model card is refreshingly transparent about this, noting which models used which harnesses and where scores came from official leaderboards versus internal evaluations.

The Open Checkpoint Is Not the Unrestricted One

Here’s the part that should make you pause. Moonshot says it removed cyber-capability training data from parts of mid-training and reinforcement learning before releasing these weights, and the model card carries the evidence rather than leaving it as a press line.

On its internal xdev-bench-hard set, the released checkpoint scores 81.0% against 90.5% for an unrestricted checkpoint of the same model. The checkpoint without risk-reduction measures, no cyber-related data removal at mid-training and no cyber-related RL environment filtering, solves 90.5% of problems at pass@3. Whatever you download from that repository is the mitigated build.

The absolute numbers aren’t flattering in the other direction either. On ExploitBench the model scores 74.7 against 100 for GPT-6 Astra and 91.0 for Claude Opus 5.5. On ExploitGym it scores 20.7 against 42.4 for GPT-6 Astra. So the released model is both weaker than its own unrestricted variant and behind the frontier on exploitation tasks.

That combination is reasonable to want in an openly downloadable 2.8-trillion-parameter model. It’s also worth knowing if your threat model assumed open weights meant unrestricted capability.

The tech blog is explicit about the reasoning: “We aim not to release open weights that would extend the absolute frontier of cyber capability.” They identified cyber-related content embedded within the general mid-training corpus and cyber-related tasks present in the RL environment mix, a natural byproduct of training on broad data. In preliminary experiments on internal models, they found that without data removal at either stage, downstream cyber capability would increase substantially.

Their stated principle is to progressively raise the cyber capability available in open weights. They argue that making K3.1 Pro available in a non-discriminatory way benefits people who need dual-use capabilities for defensive purposes: “When a capable model is open and runs on infrastructure its users control, many more teams gain the means to audit the code they maintain, including legacy systems that rarely receive dedicated security reviews.”

The Economics of Actually Using This Thing

Let’s talk about the $20M license line, because it’s the most misunderstood part of this release. At $10 per million output tokens, one node’s estimated capital cost of roughly $550,000 to $650,000 buys somewhere between 55 and 65 billion output tokens through the API at list price. A self-hosted node only beats that if you keep it busy enough to serve more than that before it becomes obsolete, and that comparison is before electricity, operations staff, idle time, and the second node you need for redundancy.

For most teams, the honest answer is that the weights are a strategic asset and the API is the cheaper way to use the model. The weight drop matters more for what it enables than for what most organizations will actually do with it: a downloadable checkpoint is auditable, and an API is not. A 2.8-trillion-parameter model within a point of Claude Opus 5.5 on Terminal-Bench 4.0 is now something an outside researcher can inspect rather than trust.

The pricing itself is aggressive. At $2/$10 per million tokens, it’s a third below K3’s $3/$15, with cached input at $0.20. But the lower token price doesn’t make every job a third cheaper. Artificial Analysis found K3.1 Pro uses 14% more output tokens per task than K3, so the cost per Intelligence Index task is $2.11 against $2.00 for K3. You get a stronger model for about the same money per task, not the same model for less.

There’s also the Highspeed variant at $4/$20 that delivers 2-3× the speed. For agentic workloads where latency matters, that’s the one to watch.

Who Should Actually Download This?

Download it if you have a reason to hold the weights themselves: a data-residency requirement that rules out any third-party inference, a fine-tuning program that needs the base model in-house, a research group auditing behavior rather than renting it, or enough sustained volume that a dedicated node beats per-token billing. You’ll want two nodes, not one, and a plan for the KV cache if you intend to use anything close to a million tokens of context.

Don’t download it if the goal is to save money on a moderate workload, or to run a frontier-class model on hardware you already own. The 1.56 TB is the floor, not the requirement, and the requirement is a B300 or GB300-class cluster. Skip it too if your workload is program synthesis or hard science, Program Bench and Terminal-Bench-Science are where this model is furthest from the alternatives, and no amount of license permissiveness closes that gap.

The comparison to other open-weight releases is worth noting. DeepSeek’s approach has emphasized efficiency, while Moonshot is betting on raw scale. The architectural innovations in the Kimi line, from attention residuals to the Gated DSA layers in K3.1 Pro, suggest Moonshot is thinking about long-term research advantage, not just benchmark wins.

The Bottom Line

Kimi K3.1 Pro is the strongest open-weight model anyone can download right now. The gap between the best open model and the best proprietary one has shrunk from 12 points to 3 on at least one independent index, and the model trades blows with Claude Opus 5.5 and GPT-6 Astra on agentic coding tasks.

But “open weights” comes with asterisks: a custom license that isn’t OSI-approved, a $20 million revenue threshold that turns commercial resale into a negotiation, and a checkpoint that’s deliberately less capable than what Moonshot’s own pipeline can produce. The weights are out, but they’re not unrestricted, and they’re definitely not something you’ll be running on your laptop.

What this release actually changes is the competitive landscape. Every enterprise evaluating AI infrastructure now has a credible open-weight alternative to the proprietary frontier. Every researcher has a 2.8T model they can audit. And every other lab knows that the bar for “open” just got raised.

The weights are out. The real question is what the community does with them.