Weekly AI Signals: Kimi K3.1 Pro, Linux Exploits and Claude Watermarks

This week, Moonshot released the weights of a 2.8-trillion-parameter model, OpenAI reported 948 working Linux privilege-escalation exploits from a single automated run, and Anthropic began watermarking text from three Claude models. NVIDIA researchers asked whether agents need enormous context windows at all, and a dispute over Postman’s coding-agent plugins raised an uncomfortable question about who controls our developer tools.

Frontier capability is getting cheaper to obtain, and the rules around it are getting more specific, which is a bit like discovering that the motorway has speed cameras just after buying the faster car.

I will take them in the order they landed.

In this issue:

1. Kimi K3.1 Pro: 2.8 Trillion Parameters, but Can You Run It?
2. OpenAI’s AI Built 948 Linux Exploits. The Bill: $1.2m
3. Claude Adds API Controls. Postman Faces an Agent-Plugin Backlash
4. NVIDIA Asks: Do AI Agents Really Need All That Context?
5. Claude’s Invisible Watermark Is Here

---

Open Models

1. Kimi K3.1 Pro: 2.8 Trillion Parameters, but Can You Run It?

moonshotai/Kimi-K3.1-Pro model card — Hugging Face

Moonshot AI releases full weights for 28 trillion parameter Kimi K3.1 Pro — Startup Fortune, 5 November 2026

Kimi K3.1 Pro is an open-weight mixture-of-experts language model from Moonshot AI that accepts text and image input. Moonshot published its weights on Hugging Face on 4 November, after launching the model through its API in late October. According to the model card, it is a mixture-of-experts model with 2.8T total and about 104B active parameters per token, a context window of 1,048,576 tokens and text and image input, with MXFP4 weights. The card does not state a download size or hardware requirement; Startup Fortune reports the repository at 1.56 TB across 96 safetensors shards and says serving takes about eight Nvidia B300 GPUs. The eight-GPU figure is one reported configuration, not a universal minimum: quantisation, inference software, offloading and context length all move the number.

A note on “104B active”: that figure is how much of the model does the work for each token, so it drives speed and compute per token. It does not shrink the 1.56 TB you must hold, because any expert might be called on the next token (the model card lists 896 experts, with 16 selected per token plus two shared ones). Think of a library where each question only sends you to a few shelves: you read fewer books per question, but the building still has to house every shelf. The analogy stops at routing, which in a real model is learned and changes token by token.

The licence is Moonshot’s own, not a standard open-source one. The licence allows use, modification, fine-tuning and redistribution, but a licensee that operates a model-as-a-service business, and whose revenue together with its affiliates exceeds $20 million over any twelve months, needs a separate agreement with Moonshot (the licence text covers total revenue, not only API revenue). Products with more than 100 million monthly active users, or more than $20 million in monthly revenue, must also display “Kimi K3.1-Pro” in their interface. Internal use, access through Moonshot’s own products and use through certified inference partners are exempt, and applications that merely embed the model in features are not counted as model-as-a-service. The benchmark table on the card is self-reported and mixes official figures with custom harnesses, so it leads on some agentic tests (BrowseComp 92.1) and trails on others (ExploitBench 74.7 against a listed 100 for GPT-6 Astra). Tencent also announced Hy4 on 4 November and calls it open source, but its announcement says the weights will follow “in the coming days”, so I am holding that one back until they exist.

Why this matters

“Open weights” and “runnable” have drifted apart. A 1.56 TB file you can legally download is still a file you are unlikely to serve on anything smaller than a small cluster, rather like being handed the keys to a cruise ship because you once asked about a canoe. The practical value for most of us is indirect: hosted providers will serve it, prices across the market will feel the pressure, and researchers can finally inspect a model of this size. If you plan to build a product on it, read the licence’s revenue clause before you read the benchmarks. What you can do: try hosted access first, before you price any hardware.

---

Security

2. OpenAI’s AI Built 948 Linux Exploits. The Bill: $1.2m

A thousand fewer paths to root — OpenAI, 4 November 2026

OpenAI mints 948 Linux root exploits in $1.2M pipeline run — AI Weekly, 5 November 2026

OpenAI published a report on 4 November describing one autonomous run of an unreleased cyber model against the latest Linux kernel, scanned in mid-October. According to OpenAI, scout agents narrowed the 40M-plus lines to 5,034 audit targets, analyst agents produced 2,308 deduplicated candidate findings, 1,724 were dynamically reproduced in isolated virtual machines, and the exploit stage produced 1,169 working local privilege-escalation exploits, which variant analysis grouped into 948 unique vulnerabilities, each with a candidate patch. These are local privilege-escalation exploits, a class of attack that lets someone who already has low-privileged local access gain root under the tested configurations; they are not the same as remote compromise. The whole run cost $1,213,430 in API credits, which averages approximately $1,280 per working exploit across the entire pipeline (OpenAI prints $1,279; the exact division is $1,279.99). The $1,280 average is neither the price of developing one exploit nor what anyone would pay to buy one; OpenAI separately reports that successful exploits cost an average of $359 in credits to develop once the earlier stages had done their work.

When the roughly ten-day scan and manual analysis finished, 61 Linux privilege-escalation bugs had been patched upstream, 43 had staging patches and 299 were being reported or discussed publicly. OpenAI presents this as the maintainers’ and wider community’s response, including findings from other contributors, not as a tally of its own 948. OpenAI says human security researchers review the pipeline’s results before reports and patches go to maintainers. The human review earned its keep: in an early run, 20 of 200 reported exploits turned out to have reached root through a different 0-day than the one assigned, and OpenAI added an independent check afterwards. Every figure here is self-reported and not independently reproduced, the model is unnamed, and OpenAI’s comparison with historical Linux kernel bounties ($20,000 at Pwn2Own, $70,000 at TyphoonPWN) is hypothetical, not a claim that all 948 would qualify. OpenAI also says it focused on capability, not cost, and calls its reported costs “more an upper bound”.

Why this matters

A price per exploit is the number that changes the argument: about $1,280 on average across this run, and about $359 for the exploit-development stage alone. Finding a bug used to be the scarce, expensive step, and problems that once took weeks of manual digging may now be discoverable systematically, which is an opportunity for defenders. But finding is only half the job. Someone still has to verify reports, prioritise fixes, review patches and coordinate disclosure, and the scarce step may now be a volunteer maintainer reading report 600 of 948 on a Tuesday evening. The candidate patches may help, and OpenAI says human researchers review results before disclosure, but whether the overall workload for maintainers falls is an open question. The ten-day figures (61 patched, 43 staged) are a snapshot that also includes other contributors’ findings, so they are not a count of outstanding tasks. What you can do: if you maintain an open-source project, assume machine-generated reports are coming, decide now how you will triage them, and check findings against the latest code before reporting, as OpenAI itself recommends.

---

Developer Tooling

3. Claude Adds API Controls. Postman Faces an Agent-Plugin Backlash

Claude Platform release notes, 30 October – 5 November 2026

Desktop auto-installs Codex/Claude plugins — Postman issue #14370, GitHub

Anthropic’s release notes list three developer-facing changes in the window. Message threads (beta, 2 November, header message-threads-2026-08-12) keep the conversation on the server, so each request sends only new messages; a thread expires five minutes after its last request and is deleted within an hour. An IP allowlist (beta, 5 November) accepts up to 1,000 IPv4/IPv6 addresses or CIDR ranges per organisation in the Claude Console and refuses everything else. And fast mode for Claude Opus 4.8 was deprecated on 30 October, with removal on 30 November, when requests with speed: "fast" will return an error; the migration target is Claude Opus 5.5.

For context on a different kind of access: an issue opened on 25 October reports that Postman desktop 12.33.4 installed Codex and Claude Code plugins on upgrade, and that the Codex installer approved Postman’s own startup hook. The issue reached the Hacker News front page on 3 November, so it is older than this week’s news. The report rests on the reporter’s logs, other commenters describe the same install after upgrading, and their findings on the hook approval differ, although the plugin’s README does confirm the hook approval on Codex. A Postman representative has since replied on the issue: the change was meant to simplify setup for developers building APIs with coding agents, the in-product and website messaging evidently did not convey that, the experience will be redesigned with the right level of control, and in the meantime the change is being reverted. The issue was closed as completed the same day, although the public thread does not show whether the reversal had reached users or whether integrations installed by earlier updates were removed.

Why this matters

Server-side threads trade control for convenience: smaller requests and lower time to first token, in exchange for your conversation living on someone else’s disk for up to an hour after its last request. The documented deletion window covers the thread, not necessarily every other log or retention rule. Server-side threads are fine for many applications and a conversation to have with your security team for others. What you can do: review your organisation’s retention and IP allowlist settings before adopting threads. The Postman report is a useful reminder that your agent’s configuration files are now a place where other software can write things; check what is in ~/.codex and ~/.claude the way you would check your crontab. A rollback of automatic installation does not necessarily remove files that were already installed, so look even after the vendor’s announced reversal.

---

Research

4. NVIDIA Asks: Do AI Agents Really Need All That Context?

You don't need long context — full paper, arXiv:2611.05306, 3 November 2026

You don't need long context — Hugging Face Papers, submitted 4 November 2026

A paper from NVIDIA researchers, published on 3 November, claims that frontier models keep nearly all of their accuracy on long-horizon and long-input tasks if the context is compacted frequently. Context compaction is a technique that replaces a growing history with a short summary of what the next step needs, so that an agent works from a compact description of its current state instead of every earlier instruction and tool result. The paper also reports that performance on long software-engineering tasks holds up even when the model takes at most one action per context. The authors measured generation at a 256K context costing 3.6x to 7x more per token than at 16K across three open-weight models on H100 nodes, and use this to propose “semantic state space models” that carry a compact natural-language state instead of the full history (a proposal the paper does not test directly).

In the paper, relative accuracy under frequent compaction ranged from about -3.7 to +5.6 points for Claude Opus 4.5 and from -3.3 to +4.4 for GPT 5.6 Sol, with estimated cost savings of 2.2x to 8.8x and 2.4x to 5.0x respectively. Those savings figures come from measured deployments and an assumed cost ratio, so treat them as the paper’s estimates, not a price list. Compaction is also lossy: a summary can drop the exact error message or design constraint you need three steps later.

Why this matters

Anyone running agents knows the transcript balloons and every step pays for the whole history again, like a taxi meter running while you reread the map. If compaction holds up on your own tasks, a 1M-token window becomes a safety net, not a daily requirement. I would test this on a real agent trace with a cheap model, measuring task success, cost per completed task and how often the agent has to retrieve something compaction discarded, before and after compaction. Compaction pairs awkwardly with server-side threads, which make long histories easier to keep, not easier to justify.

---

Governance

5. Claude’s Invisible Watermark Is Here

Claude Platform release notes, 3 November 2026

How Anthropic marks Claude's text — Anthropic, 14 August 2026

Text watermarking is a technique that embeds a statistical signal in generated text so that a detector can later estimate whether a model wrote it. On 3 November, text generated by Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 began carrying Anthropic’s text watermark on the platforms listed in its support article. On Sonnet 4.6, a request that sets temperature, top_p or top_k to a non-default value might not be watermarked. Anthropic’s August explainer says the watermark adds no tokens or visible characters, so cost is unchanged. The watermark is less reliable on short or highly factual text and generally weaker in code, where fewer token choices are interchangeable. The watermark can survive light editing, although substantial rewriting may make it undetectable. Anthropic’s watermark detection API is currently in private preview. Anthropic says it is implementing watermarking to support its obligations under the EU AI Act, and its support article says it has signed the Article 50(2) Code of Practice on Transparency of AI-Generated Content, which the European Commission describes here. On Amazon Bedrock, the rollout for these three models is expected to finish by 10 November, according to the same article.

Why this matters

For most developers nothing visible changes, which is exactly why it deserves a note in your changelog. What you can do: if your pipeline explicitly sets sampling parameters, check whether those settings affect watermarking for the Claude model you use; the documented caveat is for Sonnet 4.6.

There is an important distinction between detecting AI involvement and identifying the person behind it. Anthropic says the watermark “carries no identifying information and can’t be traced to a specific person, organization, or chat”. Detection is probabilistic: it can assign a probability that text came from Claude, works poorly on small samples, and a positive result does not prove that Claude wrote a whole document. The broader question is how these signals will be read once detection tools reach more people, because a useful transparency mechanism becomes misleading if a probability is treated as proof.

---

Closing Thoughts: Managing Access to Frontier AI

The common thread this week is not simply that AI is becoming more powerful. It is that access to powerful AI is expanding faster than some of the systems needed to manage it.

Kimi K3.1 Pro makes frontier-scale weights available to more researchers, although running them remains expensive. OpenAI’s security run shows how vulnerability discovery can scale, but also why validation and patching matter. Anthropic is adding more controls to its API and marking model-generated text, Postman showed what happens when a tool installs agent plugins without asking, and NVIDIA’s researchers are questioning whether bigger context windows are always the answer.

The technology keeps advancing. Our next challenge is learning to operate it well. Are we getting better at managing AI, or just better at building more of it? Let me know what you think.

---

References

1. moonshotai/Kimi-K3.1-Pro model card — Hugging Face
2. Moonshot AI releases full weights for 28 trillion parameter Kimi K3.1 Pro — Startup Fortune, 5 November 2026
3. Tencent launches Hy4 — Tencent
4. A thousand fewer paths to root — OpenAI
5. OpenAI mints 948 Linux root exploits in $1.2M pipeline run — AI Weekly
6. Claude Platform release notes — Anthropic
7. Desktop auto-installs Codex/Claude plugins, issue #14370 — Postman on GitHub
8. You don’t need long context — arXiv:2611.05306
9. You don’t need long context — Hugging Face Papers
10. How Anthropic marks Claude’s text — Anthropic
11. How Claude marks AI-generated content — Claude Help Center
12. Strong backing for the Code of Practice on transparency of AI-generated content — European Commission