Ethereum co-founder Vitalik Buterin has backed Moonshot AI’s decision to remove advanced offensive hacking capabilities from its Kimi K3.1 Pro model. He says limiting dangerous use cases is preferable to restricting who can use AI, but warns that serious AI-driven attacks could push governments toward mandatory identity checks and broader surveillance.
Why Buterin supports the limits
Buterin made the comments in an October 26 post on X after Moonshot announced Kimi K3.1 Pro on October 23. The model is already available through Moonshot’s applications and API, and the company plans to publish its full open weights by November 4.
His argument focuses on the difference between limiting what an AI can do and limiting who can access it. “Discriminating against use cases is much less bad than discriminating against users,” he wrote, supporting Moonshot’s choice to leave top-end offensive cyber capabilities out of its training data.
Buterin said the world needs more time to prepare for increasingly capable AI attacks. He called for stronger infrastructure, reviews of older software and formal verification for new code. Formal verification uses mathematical methods to check whether software meets specified requirements.
He did not claim that removing dangerous training material would stop other developers from building more capable systems. When asked whether rival laboratories would eventually develop advanced offensive capabilities anyway, Buterin replied, “Yes of course they will.”
What Moonshot removed
Moonshot said developers removed selected cyberattack-related material from Kimi K3.1 Pro’s training and reinforcement-learning process. The company retained general programming capabilities while excluding data tied to advanced offensive cybersecurity.
The change reduced performance on Moonshot’s internal exploit benchmark. An unrestricted version solved 90.5% of tasks, while the released model solved 81%, a difference of 9.5 percentage points.
That comparison does not prove the restriction will prevent real-world attacks. Moonshot has not published evidence showing how the benchmark reduction translates into fewer successful cyberattacks outside its testing environment.
The restricted model still scored much higher than the earlier Kimi K3, which reached 33.3% on the same internal assessment. Moonshot also reported that K3.1 Pro scored 65.7% on Terminal-Bench 4.0, compared with 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. Those figures come from Moonshot’s own testing and have not been independently verified.
Buterin’s warning about KYC
Beyond cybersecurity, Buterin warned that AI-related failures could lead governments and technology companies to impose stricter access controls. He described a possible future with locked-down models, mandatory Know Your Customer checks and intrusive surveillance.
KYC refers to identity verification processes that require users to provide documents or personal information before accessing a service. Buterin warned that access to advanced AI could become tied to nationality, identity documents or other credentials.
He said such systems could create “second or third or fourth-class” users based on their qualifications or citizenship. His concern is that security measures could become broad identity controls rather than narrowly targeted safeguards against misuse.
The warning is consistent with Buterin’s recent work on private AI access. On October 16, he introduced a privacy-focused setup using Tor routing, anonymous payments through zkAPI and local prompt rewriting to reduce the personal information exposed to outside AI models.
Cybersecurity remains a blockchain concern
Buterin’s comments come as AI-assisted attacks become a growing concern for blockchain developers. In September, he rejected the idea that AI-powered hacking would make cybersecurity unwinnable. He argued that automated verification could help defenders find and fix weaknesses before software is deployed.
In May, he identified potential uses for AI-assisted verification across Ethereum’s zero-knowledge virtual machines, cryptographic proofs, consensus systems and quantum-resistant security research.
Independent researchers have also examined Moonshot’s earlier models. In July, the U.S. Center for AI Standards and Innovation and the United Kingdom’s AI Security Institute tested Kimi K3 against simulated cyberattacks. They found it performed below leading cyber-capable systems but could still attempt offensive operations despite existing safeguards.
In one simulated corporate-network attack, Kimi K3 completed an average of 17 steps out of 32, compared with 28.5 for the most capable U.S. models tested. That assessment covered the earlier Kimi K3 model, not the newly released K3.1 Pro.
What the trade-off means
Moonshot’s approach shows a trade-off between capability and safety. Removing offensive hacking data may reduce the model’s usefulness for certain security research or penetration-testing tasks, but it may also reduce the risk that the system can carry out sophisticated attacks.
Buterin’s support does not mean he believes AI safety restrictions are a complete solution. His comments suggest he sees capability limits as a temporary measure that gives defenders more time to improve software security.
The larger debate is whether AI companies should restrict dangerous capabilities, require user identity checks, or rely on technical defenses. Buterin’s position favors limiting harmful use cases while warning that identity-based controls could create privacy and access problems for ordinary users.
What to watch next
Moonshot plans to release Kimi K3.1 Pro’s open weights by November 4. Once released, independent researchers may be able to examine the model more closely, although open weights do not automatically reveal the full training data or safety process.
For blockchain and cybersecurity teams, the key question is whether AI systems can improve defensive testing faster than attackers can improve offensive capabilities. Buterin’s answer is that stronger verification and better software security should be priorities now, rather than waiting for AI-driven attacks to force harsher access rules.
