On this page
- The promised Kimi K3 release actually happened
- The architecture is not just 2.8 trillion parameters wearing a trench coat
- Kimi Delta Attention handles the long road
- The model was trained for deployment, not embalmed after training
- The benchmark sheet is impressive, with the usual fine print
- “Open” has a license, and this one has teeth
- Hacker News immediately tried to fit it in a basement
- The NVIDIA-backed industry letter is self-interested. It is also right.
- Closed models are convenient. A closed-model world is a terrible idea.
- Open weights are not automatically safe, democratic or cheap
- Kimi K3 changes the negotiating table
Kimi K3’s full weights are now sitting on Hugging Face. Not a teaser, not an API wearing an “open” hat, not a promise for next quarter. Moonshot AI has published a 2.8-trillion-parameter model, its custom license, inference instructions, and a 48-page technical report. The file cabinet is open. You may need a data center to lift the drawers.
The timing is almost comically perfect. Three days earlier, NVIDIA published Open Weights and American AI Leadership, a letter signed by NVIDIA, OpenAI, Google, Microsoft, Meta, Mistral, Hugging Face, Mozilla, IBM, AMD, Y Combinator and dozens more. The notable frontier lab missing from that crowded footer is Anthropic.
Then Anthropic released Claude Opus 5, OpenAI introduced an optional ChatGPT feature that connects medical records and Apple Health data, and Moonshot released downloadable checkpoint weights that users can inspect, modify and self-host, subject to the license and substantial hardware requirements. That is the AI industry in one week: increasingly capable systems moving deeper into private life, a few vendors asking us to trust their sealed machinery, and an open-weight model large enough to make that trust optional for organizations with serious hardware.
This is not really a story about which chatbot wins a benchmark by 0.7 points. It is about who gets to own the intelligence layer of the economy.
The promised Kimi K3 release actually happened
When I wrote about Kimi K3 on July 20, Moonshot had launched the hosted model and promised weights by July 27. The correct description then was “open-weight with an asterisk.” The asterisk is gone.
The Hugging Face repository now contains the model, and the GitHub repository contains the code, license and technical report. Moonshot calls K3 the first open 3T-class model. More precisely, it has 2.8 trillion total parameters and 104.2 billion activated parameters per token.
That second number matters more in daily operation. K3 is a sparse Mixture of Experts model. It has 896 routed experts and activates 16 of them for each token. A giant hotel, yes, but each guest still receives only sixteen keys instead of barging into all 896 rooms.
The model is natively multimodal, accepts text, images and video, and supports a one-million-token context window. Its post-training includes general reasoning, coding and agentic work at multiple reasoning-effort levels. Moonshot says it is designed for long engineering sessions and knowledge work where the model keeps tools, repositories, documents and its own execution history in context.
Most refreshingly, the report’s abstract admits that K3 still trails the strongest proprietary models, specifically Claude Fable 5 and GPT-5.6 Sol, in overall performance. A technical report acknowledging that somebody else’s product is better is practically an endangered species.
The architecture is not just 2.8 trillion parameters wearing a trench coat
K3’s claim to importance rests on an efficiency stack, not merely size. The report says its architectural, data and training changes deliver an approximately 2.5x scaling-efficiency improvement over Kimi K2 on fitted validation-loss curves. That is a vendor result, not an independently replicated law of nature, but the mechanisms are concrete enough to inspect.
Kimi Delta Attention handles the long road
Each repeated attention block uses three Kimi Delta Attention layers followed by one global Gated MLA layer. KDA is a recurrent linear-attention mechanism with a channel-wise forget gate. The recurrent design reduces the quadratic-in-sequence-length cost of conventional attention in every layer, while periodic global attention restores high-capacity token mixing.
Attention Residuals change how information moves through depth. Instead of every layer inheriting one accumulated residual stream like a photocopy of a photocopy, modules can selectively retrieve representations from the embedding, current block and preceding blocks. Along model width, Stable LatentMoE performs the sparse expert routing.
For vision, Moonshot trained MoonViT-V2 from scratch with the same next-token objective, rather than bolting on a separately pretrained vision encoder. Text and visual tokens are interleaved during pretraining. The vision corpus includes captions, OCR, video, webpages, games, CAD schematics and rendered code.
The model was trained for deployment, not embalmed after training
K3 uses quantization-aware training from supervised fine-tuning onward. Expert weights are represented in MXFP4, expert activations in MXFP8, while non-expert components remain in BF16. That makes the released checkpoint smaller and reduces serving cost without asking a third party to crush a finished high-precision model and hope the personality survives.
Moonshot extends context progressively from 8K to 64K during pretraining, then from 256K to one million tokens during cooldown. For agentic reinforcement learning at million-token scale, the team describes persistent sandbox state, reusable prefix caches, CPU offload and co-located training. It says individual 1M-context RL experiments stayed within a few hundred GPUs. That is “efficient” in frontier-lab language, a dialect in which a few hundred GPUs counts as restraint.
The report does not disclose the total pretraining token count, total training FLOPs, full hardware bill, complete data provenance, or a substantial model safety evaluation. It describes broad data categories and filtering pipelines, but not enough for outsiders to audit copyright, contamination or representational gaps. Open weights make later inspection possible. They do not retroactively turn an incomplete disclosure into a complete one.
The benchmark sheet is impressive, with the usual fine print
Moonshot reports 73.0 on DeepSWE, 84.6 on Terminal-Bench 2.1, 71.3 on FrontierSWE, 91.2% on BrowseComp and 95.0 F1 on DeepSearchQA. It also reports 94.5% on MCPMark-Verified and strong multimodal scores, including 91.1% on OmniDocBench.
Those reported results make K3 a plausible frontier contender. They do not establish that it wins every workload. Several comparisons are run by Moonshot, some use internal benchmarks, models receive maximum reasoning effort, and agent harnesses differ. The report labels internal evaluations, which is better than hiding them in a footnote, but independent providers now need to reproduce the public results on the released checkpoint.
The released weights make independent, version-pinned testing substantially more reproducible, although exact replication still depends on Moonshot publishing its prompts, harnesses, tool environments and inference settings. Closed-model benchmarking is partly theatre because the performer can change backstage while the audience is still scoring the last act. With K3, researchers can freeze a checksum, inspect the public inference code, vary quantization, measure energy and run the same artifact again next month.
“Open” has a license, and this one has teeth
Open weight and open source are not synonyms. Open weights make trained parameters available, while open-source status depends on whether the accompanying software, documentation and license satisfy an applicable open-source definition. Neither term necessarily means the original training run can be reproduced. Downloadable weights are enormously useful, but they do not reveal every training example or make the model cheap to operate.
The Kimi K3 License permits use, copying, modification, distribution, fine-tuning and derivative works. It also imposes two notable conditions:
- A company operating a model-as-a-service business with more than $20 million in aggregate revenue over any consecutive 12 months must negotiate a separate agreement with Moonshot before commercial use.
- A commercial product with more than 100 million monthly active users or over $20 million in monthly revenue must prominently display “Kimi K3” in its interface.
Internal use is exempt, as are Moonshot’s official products and certified inference partners. This is much more open than a hosted API, but its field-of-use and commercial conditions may prevent it from qualifying as open source under OSI criteria. Several Hacker News commenters focused immediately on those conditions. One commenter quoted the $20 million service threshold; another observed that the attribution rule is smart marketing. Correct on both counts.
Hacker News immediately tried to fit it in a basement
The first Hacker News thread is 400-plus comments of exactly the sort of useful chaos that a weight release creates. People estimated roughly 1.5 TB just for MXFP4 weights, debated eight versus sixteen B200 GPUs, proposed used multi-socket servers stuffed with terabytes of RAM, and then calculated whether the electricity bill would make the API look charitable.
One commenter called the release historic because an open-weight model is finally near the top, adding the important caveat that most individuals still cannot run it. Another argued that extreme privacy can justify slow local inference. A reply asked whether an audited cloud such as AWS already solves that problem. The answer is not universal: regulatory compliance, operator trust, foreign jurisdiction, trade secrets and cryptographic control are different requirements that procurement departments routinely blend into one sad spreadsheet.
The technical-report thread moved up a level, from “can my workstation run it?” to “should a large enterprise buy a rack?” A back-of-the-envelope calculation proposed that a heavily used GB300 rack could push output costs below hosted frontier APIs. Replies correctly added administrators, financing, utilization, failures and the possibility that today’s brilliant model becomes next quarter’s expensive antique.
One concise comment captured the economic argument: having these models in the open caps the inference margin. Even companies that never download K3 may benefit. A credible exit option changes the price a closed provider can charge, the contract it can demand and the amount of lock-in a customer must swallow.
That cap is neither automatic nor universal. K3’s hardware requirements limit the number of credible operators, and its license requires larger model-as-a-service businesses to obtain a separate agreement. Those constraints may reduce exactly the inference competition that open weights would otherwise encourage.
The NVIDIA-backed industry letter is self-interested. It is also right.
The NVIDIA-backed letter argues that American leadership will not be judged by possession of one supreme model, but by whether AI diffuses through factories, hospitals, farms, classrooms and small businesses. It asks policymakers to expand compute access, invest in shared datasets and evaluation tools, avoid premature restrictions on open models, and distinguish legitimate distillation from unlawful extraction.
NVIDIA sells the shovels, so naturally the company has discovered a moral principle requiring more people to dig. Open weights create demand across chips, clouds, fine-tuning, inference software and enterprise deployment. This is not disqualifying. Self-interest and good policy occasionally occupy the same chair without the furniture exploding.
The signatories are remarkable because they include direct competitors and several owners of closed frontier models: OpenAI, Google and Microsoft all signed. The list also spans AMD, Cloudflare, Cisco, Dell, GitHub, Meta, Mistral, Mozilla, the Linux Foundation, Hugging Face, IBM, Perplexity, Replit, Y Combinator and many infrastructure startups.
Anthropic did not sign. The PDF gives no reason, so claiming a policy disagreement would be fan fiction. What we can say is that Anthropic launched Claude Opus 5 as a closed service in the same week and claimed near-Fable 5 capability at half the price. Excellent product, sealed engine.
Closed models are convenient. A closed-model world is a terrible idea.
A closed API can be the rational choice. It removes hardware operations, delivers frequent upgrades and can provide compliance, support and strong safety controls. Claude, GPT and Gemini often lead capability evaluations. Pretending otherwise does not help the open-model case.
The problem begins when convenience becomes the only available constitutional arrangement for machine intelligence.
- Prices become policy. If three labs mediate advanced reasoning, their margins and product bundles decide which applications are economically viable.
- Terms become law. A provider can change retention, acceptable use, model behavior, rate limits or geographic access without shipping you the previous version.
- Research becomes permissioned. Outsiders can probe inputs and outputs, but cannot inspect weights, reproduce an exact deployment or investigate hidden mechanisms directly.
- Failure becomes concentrated. One outage, policy mistake, safety regression or political demand can affect thousands of downstream businesses at once.
- Knowledge walks out with the vendor. Fine-tuning, prompts, evaluations and workflow design accumulate around a model you do not own and may not be able to replace.
This week OpenAI said more than 300 million people each week ask ChatGPT health questions, then launched a feature connecting medical records and Apple Health. OpenAI says connected health data and related conversations will not train foundation models or target ads. Good. But the larger point is unavoidable: the more intimate the context, the more valuable a verifiable option to run models under infrastructure you control.
Open weights are not automatically safe, democratic or cheap
The strongest counterargument deserves more than a ceremonial paragraph. Once capable weights are released, the developer cannot revoke them. Safeguards can be removed. Cyber, biological and influence capabilities can be fine-tuned and distributed. Attribution becomes harder. K3 is also so large that access remains unequal: a downloadable 1.5 TB model does not democratize frontier inference in the same way a 7B model running on a laptop does.
The letter answers that defenders need comparable models, closed systems also fail, and concentrated services create single points of failure. That is partly right, but “more eyes” is not a magic spell. Many people can inspect a model while nobody funds the tedious evaluation, patching and incident response. Open-source software security works when communities, vendors and institutions do that labor, not because GitHub radiates virtue.
We need capability-sensitive evaluations, liability for harmful deployment, secure model distribution where justified, serious cyber defense, transparent incident reporting and access to compute for independent researchers. What we do not need is a policy that treats secrecy as safety and hands a permanent intelligence franchise to whichever companies raised the most money in 2025.
Kimi K3 changes the negotiating table
K3 will not replace every closed model tomorrow. It is enormous, operationally demanding, incompletely documented and covered by a custom commercial license. Moonshot’s own report says the best proprietary models remain ahead overall.
Yet K3 changes what “open” can mean at the frontier. A university can study the actual artifact. A sovereign cloud can deploy it. An enterprise can keep sensitive context on premises. A competitor can distill or specialize it within the license. An inference provider can expose real serving economics. A safety team can test more than the public personality an API chooses to show.
Most importantly, a sufficiently large or technically capable customer can point to the weights and say, “We have an exit option.” Markets behave much better when that sentence is credible.
The future should not be one open model defeating one closed model. That is just a different monoculture. It should be a plural market of closed services, open weights, small local models, giant shared models, specialized derivatives and independent evaluators, all forcing one another to improve. Competition is not a side effect of AI progress. It is the mechanism that keeps progress from becoming rent.
Kimi K3 is not freedom in a download folder. It is 2.8 trillion parameters of leverage. For one unusually consequential week in AI, that may be the most important benchmark of all.
Keep reading