Two Chinese models now lead the publicly available models on an independent leaderboard for AI cyber defense. On the Artificial Analysis Cyber Index, Moonshot AI's Kimi K3.1 Pro scores 64 and DeepSeek V4.1 Flash 1017 (Max) scores 57, as of the page we checked on October 27, 2026. Grok 4.7 (Xhigh) is next at 56. Only GPT-6 Sol (Daybreak Blue, max), a trusted-access model that is not publicly available, scores higher in the page's chart data, at 69.
The result matters for two reasons. Moonshot says it deliberately held back K3.1 Pro's hacking ability before its open-weight release, and Beijing is drafting export rules that cover systems that generate malicious software and very large models. A high defensive score, a deliberate offensive cap and a new filing regime now all bear on the same two Chinese labs.
What the Cyber Index measures
Artificial Analysis, an independent benchmarking firm, describes the index as "a composite index of model capability on cyber defense." It averages three evaluations with equal weight:
- CWE-Bench-AA, based on Collinear AI's CWE-bench, scored pass@1.
- DeepsecBench-AA, based on Vercel's DeepsecBench, scored as F2, the median of three runs.
- CyberGym-E2E-AA, based on CyberGym-E2E from the Berkeley Center for Responsible, Decentralized Intelligence, scored pass@1.
Together they test the defensive loop: find a vulnerability in a codebase, reproduce and validate it, then patch it without breaking the software. The firm says it runs all evaluations itself. Its FAQ is clear on one limit: "The Index measures defensive work only." Models work from source code, and Artificial Analysis says it does not ask any model to build a working exploit. The index is separate from its better-known Intelligence Index and does not feed into it.
The page lists 23 models and marks trusted-access models, which are not publicly available, separately. It also tracks "safety blocks," the share of tasks a model or its provider declines on safety grounds. A declined task scores zero.
DeepSeek's jump
DeepSeek's result came first. In a post announcing it, Artificial Analysis called DeepSeek V4.1 Flash 1017 "the #1 openly-available model for cyber defense capabilities" at 57%, one point ahead of Grok 4.7 (xhigh) and Xiaomi's MiMo-V2.6-Pro. In that post it placed the model second overall, behind OpenAI's trusted-access GPT-6 Sol (Daybreak Blue, max) at 69%.
The firm said the score rose 16 points from the earlier DeepSeek V4.1 Flash (max), from 41% to 57%. Almost all of the gain came from one test. According to Artificial Analysis:
- CyberGym-E2E-AA rose from 23% to 76%.
- CWE-Bench-AA moved from 68% to 69%.
- DeepsecBench-AA fell from 31% to 25%.
So the new checkpoint is much better at the reproduce-and-patch work in CyberGym, and slightly worse at the code-review findings that DeepsecBench scores. In the same post, Artificial Analysis put the DeepSeek model's cost at $0.42 per task, against $1.77 for GPT-6 Sol (Daybreak Blue, max). We covered the model itself in our DeepSeek V4.1-Flash-1017 report.
Kimi K3.1 Pro moves ahead
Moonshot launched Kimi K3.1 Pro on October 23 (see our Kimi K3.1 Pro explainer). It is available through Kimi apps and the Kimi API now, and Moonshot says the full weights will be released by Nov 4, 2026. Artificial Analysis now lists it at 64 on the Cyber Index, seven points ahead of DeepSeek and the highest score of any publicly available model. The page's chart data still shows the trusted-access GPT-6 Sol (Daybreak Blue, max) higher, at 69.
The ranking sits next to Moonshot's own account of its cyber work. In its launch blog, Moonshot says it found cyber-related content in its general mid-training corpus and in its RL environment mix, and removed it from both stages for the open-weight release. On its in-house xdev-bench-hard test, which asks the model to write working exploits, Moonshot says a checkpoint without these controls solved 90.5% at pass@3 and the final model solved 81.0%. These are Moonshot's own numbers.
Moonshot wrote: "we aim not to release open weights that would extend the absolute frontier of cyber capability." It also says K3.1 Pro's cyber capability "remains behind that of frontier proprietary models that have been publicly available for at least three months."
The two claims are not in direct conflict. Moonshot's test measures exploit writing, which it tried to reduce. The Artificial Analysis index measures audit and patch work, which it says excludes exploits. Moonshot argues that open, capable models let "many more teams" audit the code they maintain. The defensive score is the evidence for that side of its argument; it says nothing on its own about how much the data removal limits misuse.
The export rule in the background
China's commerce and science ministries proposed export controls on 23 AI technologies on October 16. Reuters reported that the ministry said the controls were partly meant to prevent misuse, including systems capable of autonomously generating and modifying malicious software. Access through APIs, websites, apps and software-as-a-service is excluded, and the public comment period closes November 15. Registration of certain overseas technology transfers took effect at once.
According to China AI Dispatch's reading of the draft, the restricted tier covers weights, checkpoints, source code and other technology for any model trained with at least 10^26 operations, or with at least 2 trillion parameters, or whose capability reaches what the annex calls a globally leading level. Technology already public through open source or a paper is outside the list, and the ministry's Q&A lists open-sourcing among cases that get an automatic license. Kimi K3, the predecessor of K3.1 Pro, has 2.8 trillion parameters by that newsletter's count. The newsletter's reading is that the next open release above the line starts with a filing, and that the filing is a formality.
There is precedent. The South China Morning Post reported on October 23 that DeepSeek and MiniMax had completed export registration and gone ahead with open-source releases and overseas licensing, citing Yuyuan Tantian, a social media account affiliated with state broadcaster CCTV. We found no public report on whether Moonshot has filed for K3.1 Pro. Our earlier report covers the draft export controls.
Why it matters
For security teams, the top publicly usable models for audit-and-patch work on this index are now Chinese, and DeepSeek's costs $0.42 per task in Artificial Analysis' data. Under a DHS order made public on October 19, US civilian agencies must remove DeepSeek products, so a high score does not change procurement rules there.
For policy, the result shows a dual-use tension. The same coding skill that patches bugs can help find bugs to attack. Moonshot is trying to cap the offensive side by removing training data, Artificial Analysis is measuring the defensive side, and Beijing is building a filing system for the weights. K3.1 Pro's weights, due by November 4, will bring all three together.
Sources
- Artificial Analysis Cyber Index
- Artificial Analysis post on DeepSeek V4.1 Flash 1017 (LinkedIn)
- Kimi K3.1 Pro launch blog (Moonshot AI)
- Reuters via StreetInsider: Beijing seeks tighter grip on AI exports
- China AI Dispatch: Sending a Chinese model's weights abroad now needs a filing
- South China Morning Post: DeepSeek, MiniMax secure open-source licences
