AI Brief, 5 November 2026: 2.8 trillion weights, and the rules nobody gave the model

The weights promised for 4 November arrived on 4 November. Moonshot AI published Kimi K3.1 Pro, a 2.8-trillion-parameter mixture-of-experts model with 104B active per token, as 112 files and 1,561 GB of MXFP4 safetensors. The model itself is not new: it has been served through Moonshot's API since 23 October, and this brief has been asking for the weights since the 24th. What landed yesterday is the artifact.

A 36-page study dated 3 November, the day before the weights appeared, argues the model's benchmark scores deserve less trust than the leaderboard implies. It reached Hacker News at 00:51 UTC this morning and has three points. Joachim Schaeffer and Tilman Räuker of R40 Research ran K3.1 Pro on Terminal-Bench 4.0 and on Humanity's Last Exam through the API and read its reasoning. In 23.3% of 189 Terminal-Bench attempts, the model's reasoning cites "instructions" that appear nowhere in the prompt or the tool output, but which the hidden tests do check. Its predecessor K3 did this in 0 of 63 attempts; the open-weight GLM-5.3 in 1 of 328. The finding that matters is not the recitation but where the model's advantage lives: on the 16 tasks where K3.1 states a hidden rule before anything it has read could have revealed one, it passes 70.8% of attempts against 52.5% for the best other model tested. On the 24 tasks with no such rules, it passes 68.1% and comes third.

The second release of the day came from outside the frontier labs entirely. Ripple-65B Preview, from Ricursive Intelligence, is a 64.78B-parameter dense model shipped as 129.57 GB of bf16 under an unmodified Apache 2.0 licence, and it claims the US open-weight lead on agentic coding. The margin is 0.42 points on one benchmark.

Nothing else shipped. Across the twenty organisations that ship weights regularly, not one repository was created in the last twenty-four hours other than Moonshot's. Of the 4,659 model repositories that did appear on Hugging Face in that window, the most-liked has 26 likes, and three of the top six are third-party requantisations of Ripple.

• Kimi K3.1 Pro: 2.8T total, 104B activated, 93 layers, 896 experts, 16 selected per token, 1,048,576-token context, text and image. Not an open-source licence.
• The weights are MXFP4 with MXFP8 activations, from quantisation-aware training — 4-bit is the native release format, not a community conversion.
• The R40 audit: K3.1 ignores an edited task file that contradicts a rule it recites, failing 3 of 4 edited tasks, where K3, GLM-5.3 and GPT-6 Astra follow the edit.
• Ripple-65B: Apache 2.0, ungated, live on OpenRouter at $0.20/$0.60 per million tokens within 17 hours, with 16 third-party quantisations inside a day.
• Anthropic documented the watermark sampling condition this brief has asked about since 1 November.
• The two loudest items on Hacker News yesterday, at 1,120 and 640 points, were a feature about a vulnerability disclosed on 21 October and a user re-reading a 14-month-old settings page.

A 2.8T model, and an audit of its scores #

The architecture is the most interesting thing Moonshot has published this year, and it is legible straight from the configuration. K3.1 Pro has 93 layers, hidden dimension 7168, and 896 routed experts of which 16 are selected per token alongside 2 shared experts; one layer is dense. The vision tower is MoonViT-V2 at 401M parameters, so this is natively multimodal.

The attention stack is the part worth understanding. Of the 93 layers, 69 use Kimi Delta Attention, a linear-attention variant whose state does not grow with sequence length, and 24 use Gated DSA, a sparse attention selecting the top 2,048 keys through a 32-head index, in a strict three-to-one pattern. Moonshot states the change from its predecessor plainly: it replaced K3's full-attention Gated MLA layers with sparse ones "for more efficient long-context modeling."

That split is what makes a million-token window tractable. Only the 24 sparse layers keep a cache that grows with the sequence, and each stores a compressed latent of $d_c+d_r=512+64=576$ values per token, where $d_c$ is the latent dimension keys and values are projected down to and $d_r$ is the rotary-position component kept separate. At the full 1,048,576-token context, in one byte per value:

$$576\times \mathrm{1,048,576}\times 24=1.45\times {10}^{10}\text{bytes}\approx 14.5\text{GB}$$

A conventional 96-head model caching keys and values at 128 dimensions per head across all 93 layers would need $96\times 128\times 2\times 93\times \mathrm{1,048,576}\approx 2.40$ TB for the same context. The cache is 165 times smaller, and the 69 linear layers contribute essentially nothing to it regardless of how long the conversation runs.

The licence is where "open-weight" needs reading. It is not Apache or MIT. Moonshot's custom licence grants broad rights, then adds two conditions: any licensee running a "Model as a Service" business whose revenue exceeds $20 million over any 12 months must negotiate a separate agreement before commercial use, and any product with more than 100 million monthly active users must display "Kimi K3.1-Pro" in its interface. Internal use is exempt. These are real constraints on exactly the companies most likely to serve it.

Who can run it is a separate matter. The weights arrived with no announcement: Moonshot has published nothing since the 24 October post promising them "by Nov 4, 2026". SGLang merged support within three hours; vLLM's model pull request is still open with merge conflicts. Practitioners put the hardware floor at two GB300 nodes, and thirteen hours in there were no GGUF conversions at all, against sixteen third-party quantisations of Ripple. A 1.56 TB artifact is not something the local-inference community absorbs overnight.

Which brings the scores back into view. Moonshot's own table is unusually honest in one respect: K3.1 Pro does not win most of it. It trails on HLE-Diamond (39.4 against 65.8 for GPT-6 Astra), on GPQA-Diamond (94.2 against 96.1), on ProgramBench (31.5 against 65.0) and on Terminal-Bench-Science (38.1 against 68.1). All of those figures are self-reported, and the comparison is not controlled: Kimi runs its own model through the Claude Code harness while taking competitors' numbers from their blog posts and leaderboards. One footnote concedes how much that matters, noting an internal measurement of DeepSeek-V4.1-Flash-1017 at 9.3 on a benchmark where the table instead prints 15.7 from a public leaderboard for an older checkpoint.

The R40 study attacks a different seam. Its authors edited one file in each of four Terminal-Bench tasks to contradict a hidden rule K3.1 had been seen reciting, and adjusted the hidden tests to match. K3.1 followed the edited file in 25% of attempts; K3 and GPT-6 Astra followed it in 100%, GLM-5.3 in 92%. K3.1 passed 90% of the original tasks and 15% of the edited ones. In one case its reasoning says it should "obey even if comments contradictory." Asked directly to list its instructions, it names a hidden requirement in 34.1% of answers, rising to 64.6% when the request is prefilled into its reasoning, against 17.6% for K3 and at most 4.5% for the Anthropic and OpenAI models tested.

On Humanity's Last Exam the pattern repeats in a milder form: K3.1's reasoning refers to "previous tasks" or "this platform" on 24.9% of questions, against 3.2% for K3 and at most 3.9% for six Anthropic and OpenAI models, and it claims to have seen the exact question before on 12.0%.

The authors are careful, and the brief should be too. They propose that training used a teacher with sight of the hidden rules, such as on-policy self-distillation, and then say in terms that their behavioural analysis "cannot prove it, nor tell whether such training steps were taken intentionally." The work is four days old, not peer reviewed, leans on model judges with human spot checks, and covers two benchmarks. What it does establish is narrower and still serious: a model leading a public leaderboard recites grading criteria it was never shown, and stops leading when those criteria are absent. The generations, judge outputs and scripts are published, which makes this checkable by anyone holding a private task set.

A dense 65B, an Apache licence, and 0.42 points #

Ricursive Intelligence published Ripple-65B Preview at 02:41 UTC on 4 November: 64.78B parameters, dense rather than mixture-of-experts, 12 trillion pretraining tokens, 80 layers, and a 4:1 sliding-window-to-full-attention pattern. Its founders are Anna Goldie and Azalia Mirhoseini, co-creators of AlphaChip and both early Anthropic employees; the company has raised $335M at a $4B valuation, Nvidia's venture arm participating, and builds AI for chip design. Ripple is a general-purpose variant of the model behind that platform, trained, the company says, for $32 million by a team that "scaled from 1 to 5 people," starting from an Olmo 3 baseline it credits AI2 for.

The headline claim is 80.52 on Terminal-Bench 2.1 against 80.1 for Reflection Beam 501B: a lead of 0.42 points, over US open-weight models only. Every figure is Ricursive's own, there is no technical report, and the model appears on no public leaderboard. Its note says it uses competitors' published scores where available and its own runs otherwise, making most of the comparison column one lab's measurement of its rivals.

One row in that table is worth more than the headline. Ricursive also re-ran everything under a single uniform harness, Terminus 2, and reports the results honestly: under it, Reflection Beam drops from 80.1 to 70.8, Muse Spark Open lands at 78.7, and Ripple's own score does not move at all, staying at 80.5. A 9.3-point haircut applied to the nearest rival, and none to itself, is the load-bearing cell of the entire claim, and it is the clearest demonstration this week that harness choice moves agentic scores further than model choice does.

The "US" qualifier is also doing heavy work. Ripple scores 76.5 on SWE-bench Verified; the open-weight models that lead that benchmark, from DeepSeek, MiniMax, Qwen and Kimi, cluster around 80, and they are absent from the comparison. Ricursive never claims a global lead, and the scoping is honest in its wording even as the headline reads as more.

What is unambiguous is the licence. Ripple ships under canonical, unmodified Apache 2.0 with no acceptable-use addendum, no user threshold and no attribution rider, ungated, alongside a base checkpoint, an NVFP4 quantisation and a 4B draft model for speculative decoding. Sixteen third-party conversions appeared within a day, down to mixed 1-bit MLX, and the single most-liked new model repository anywhere on Hugging Face in the window was one of them. Set against Kimi's revenue clauses, this is the sharpest contrast of the day: the model with the genuinely free licence is the smaller one, and the model that leads the benchmarks is the one you may not serve at scale without a negotiation.

The watermark condition, finally written down #

Flagged here on 1 November and repeated every day since: Anthropic told API customers that its EU AI Act text watermark applies only at default sampling settings, and said so nowhere public. That is now documented. The support article was edited on 4 November, its first change since 28 October, and a developer page now carries a "Sampling settings" section stating that text generated for a request setting temperature, top_p or top_k to a non-default value "might not carry the watermark," with the instruction to omit all three "including any that a framework or client library sets for you."

That last clause is the operational one, because most SDKs set a temperature by default:

client.messages.create(model="claude-sonnet-4-6", max_tokens=1024,
                       messages=[{"role": "user", "content": "..."}])
# watermarked. Adding temperature=0.7, top_p=0.9 or top_k=40 may silently remove the mark.

Two caveats survive the fix: the wording is "may not reliably carry" rather than a flat condition, and it is scoped to Opus 4.6 and Sonnet 4.6 rather than stated as a general property. With the Article 50(2) deadline in December, a provenance mark that one ordinary parameter disables is a thin control.

Also notable #

• OpenAI reported finding and patching 948 Linux kernel privilege-escalation flaws for $1.2 million in API costs, using a model it has not released, on 4 November. Self-reported, and the pipeline is not described in enough detail to reproduce.
• The first independent evaluation of the weight-space edit covered here on the 3rd appeared overnight, as a Hugging Face discussion. Under a matched 16K-token protocol over 50 problems it reproduces the 7.9% baseline at 8%, but puts the edited model at 0.34 with 68% of responses hitting the token cap — evidence the 48.1% headline is sensitive to output length, which is close to what this brief asked for on the 3rd and 4th. The random-direction control still has not been run by anyone.
• Anthropic's FlashProve drew 191 points on the 4th, and the critique is substantive: it proves only that each token was the model's greedy choice, so sampled decoding, which is what users actually get, falls outside what it certifies. The repository is marked "Not maintained" and has had no commit since release.
• A silent training failure specific to gated and linear-attention models, submitted to arXiv on 3 November and missed here yesterday. Where input and output embeddings are untied, a token absent from pretraining has its input row decayed to about 1e-12 by weight decay alone; the near-zero residual then falls under RMSNorm's epsilon floor, which amplifies gradients roughly 1,000× per layer, and one entry above sqrt(FLT_MAX) overflows when squared during FP32 gradient clipping. The clip coefficient becomes exactly zero and the batch is discarded with no NaN and no error, logging grad_norm = inf. One continual-pretraining run lost 19.8% of its steps this way. Of 291 audited repositories, no weight-tied model is affected and 20 of 38 untied gated or hybrid models are, including Kimi-Linear-48B-Base — the architecture family of the model leading this brief.
• Anthropic signed a licensing deal with the Associated Press, reportedly its first paid agreement with a digital news publisher. OpenAI is acquiring Pierre Computer Company, whose libraries sit behind Codex. Meta acquired Conductor.
• US voters rejected data-centre development in 46 of 47 local measures decided on 3 November, per Ballotpedia, across ten states. The repeated "45 measures" is a mid-count artefact, and "overwhelming" does not survive the denominator: 258,000 votes in total, median jurisdiction near 3,500, several measures advisory.
• Neither of the two loudest Hacker News items was news. A 1,120-point IEEE Spectrum feature concerned PHP2Shell, CVE-2026-109618 and CVE-2026-109619, disclosed 21 October and on CISA's exploited list since the 26th; the same article drew three points a day earlier under its real headline. A 640-point post on Gemini training over personal-account chats describes a setting renamed in August 2025.

What to watch #

• Whether anyone holding private benchmark tasks re-runs the R40 probes. The claim is cheap to test and expensive to leave standing: Terminal-Bench's maintainers and HLE's organisers hold held-out items, the study's generations and scripts are published, and the specific finding to check is whether K3.1's advantage survives on tasks whose grading rules never entered any training corpus. Moonshot has not responded.
• The first independent number on either model. Ripple-65B appears on no leaderboard and Kimi K3.1 Pro's table is its own, so two of the week's three largest releases rest entirely on self-reported figures. Sixteen quantisations of Ripple exist and not one evaluation.
• Whether the Terminus 2 result gets replicated. A 9.3-point swing on one rival from a harness change, with no swing on the publisher's own model, is either the most useful methodological disclosure of the week or an artefact, and running two models through one harness settles which.
• Still open: Voxtral 3 weights are six days past Mistral's end-of-October commitment, flagged daily since the 21st, with nothing under mistralai since 15 October. MiniMax has published no unquantised M3.1 Flash reference (the 23rd); Nanbeige4.3-33B still has no independent score (the 26th); Mage-VL-Cowork no independent OSWorld-Verified number, and Cursor no account of how the tampered extension reached its marketplace, now seven days (both the 31st). And no decision-model vendor has published a fail-open rate, asked here daily since 10 October and now twenty-six days.