FAR.AI says simple text attacks bypass Kimi K3.1 Pro safeguards

Direct refusals did not prevent high attack success

FAR.AI tested whether Kimi K3.1 Pro could be pushed into helping with CBRNE threats and cyberattacks. Direct harmful requests received a compliant answer in 0.3% of tests, according to the researchers.

The results changed when the researchers supplied the beginning of the model’s response. This response prefill approach produced a 99.4% success rate when it skipped the model’s reasoning and started the visible answer directly. A second version allowed the model to continue reasoning and achieved an average success rate of 93.3%, with at least 86% in each tested domain.

FAR.AI estimates that a new attacker would need about two and a half hours of one-time setup for either version. The researchers say both attacks use the same text for every request and every domain.

The test covered common and automated jailbreak strategies

The study focused on attackers with basic familiarity with language models, access to AI coding agents and some programming ability, but without specialist expertise in machine learning security or the threat areas being tested. FAR.AI did not retrain or otherwise modify the model, so the results apply to Kimi K3.1 Pro as released by Moonshot AI.

An AI agent built by FAR.AI searched for attacks and tested 76 jailbreak strategies. The researchers also added seven hand-written and publicly circulating variants. Three automated evaluators assessed whether each response complied with the harmful request, addressed the request and met the detail level specified by a scoring rubric. An attack counted as successful only when all three evaluators agreed.

Other approaches also produced significant results. A publicly available jailbreak reached 16% success as published and 36% after 30 minutes of adaptation. A more sophisticated attack that spoofed external tool responses reached an 84% success rate, although FAR.AI says it required greater attacker effort.

Most capabilities remained intact after the safeguard bypass

FAR.AI also tested whether the response-prefill attack reduced the model’s usefulness. Using the version that preserved its reasoning, average benchmark scores fell by 3.3 percentage points.

On 100 software tasks requiring the model to fix issues over multiple steps, Kimi K3.1 Pro solved 74.0% without the attack and 75.0% with it. The largest declines appeared on tasks involving laboratory procedures, which fell by 5.6 to 11.1 points, while a chemistry benchmark fell by 4.0 points.

The researchers also found weak biosecurity distinctions without an attack. On BioTIER, Kimi K3.1 Pro answered more than half of prohibited requests within five attempts. On a text-only subset of the Virology Capabilities Test, it correctly answered prohibited questions 54.0% of the time, compared with 57.9% for permitted questions. Both response-prefill attacks raised compliance with prohibited requests to nearly 100%.

Open-weight models have fewer safeguards after release

Moonshot AI released Kimi K3.1 Pro publicly on November 4, 2026. Because it is an open-weight model, users can download it and run it on their own hardware. FAR.AI says this removes safeguards that proprietary model providers can apply around the model, such as request screening, response monitoring and updates to defenses.

The same response-prefill attack worked on Kimi K3.1 Pro without changes after previously reaching 98.3% on Kimi K3. Within five attempts, it reached 93.3% on K3.1 Pro. With slight adjustments, the approach reached 92.5% on Meta’s Muse Spark Open.

FAR.AI recommends that Moonshot AI and other open-weight model developers train models to resist response prefilling and tool spoofing. It also recommends limiting dangerous capabilities during training when they are not needed for a model’s intended use, including by extending efforts to remove cyber-related training data to other risk areas such as CBRNE.