What happens when the people building the most powerful AI models decide to hold something back on purpose? That question sat with me this week after Ethereum co-founder Vitalik Buterin publicly backed a Chinese startup’s choice to strip advanced offensive hacking material from its newest release. In a world racing toward ever smarter systems, deliberately limiting capability feels almost radical. Yet Buterin’s take goes further. He sees this kind of restraint as a temporary shield that might keep ordinary users free from heavy identity checks and constant monitoring later on.
Why Buterin Supports Capability Limits Over User Restrictions
On October 26 Buterin posted a clear statement. He said he is fine with the decision by Moonshot AI to leave top-end offensive cyber capabilities out of the training data for Kimi K3.1 Pro. His core argument is simple but powerful. Discriminating against certain use cases is far less harmful than discriminating against the people who want to use the technology.
Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old software, and apply formal verification to new code.
I’ve found that this distinction matters more than most people realize. Restricting what a model can do still leaves the tool open to almost anyone. Restricting who can use it creates tiers of access based on nationality, paperwork, or government approval. Once that door opens, it rarely closes cleanly.
Buterin’s view rests on a practical belief. Society needs breathing room. Software stacks written years ago were never designed to face AI-driven attack tools that can probe, adapt, and exploit at machine speed. Formal verification, the practice of mathematically proving that code meets its specifications, offers one serious path forward. He has pushed this idea for months, arguing that automated verification could actually tilt the balance back toward defenders rather than attackers.
The Timing Problem Facing Every Developer
Most of us still run systems that contain layers of older code. Updating everything at once is impossible. Patching takes time, testing takes longer, and formal methods demand even more careful work. Meanwhile AI labs keep releasing stronger models. The gap between offense and defense widens unless someone deliberately slows the offense side in selected places.
Moonshot AI made that choice with Kimi K3.1 Pro. The company removed selected cyberattack-related data from both the training set and the reinforcement learning stage. General programming skill stayed intact. The result is measurable. On their internal exploit benchmark the filtered version scored 81 percent. The unfiltered counterpart reached 90.5 percent. That 9.5-point drop is not trivial, yet the new model still outperforms the earlier Kimi K3, which managed only 33.3 percent on the same test.
On Terminal-Bench 4.0 the restricted model posted 65.7 percent. Moonshot compared that figure with 66.4 percent for Claude Opus 5.5 and 58.2 percent for GPT-6 Astra. These numbers come from the company’s own testing and have not been independently audited, but they give a sense of the trade-off. Capability remains high. The most dangerous offensive edge is blunted.
What Moonshot Actually Changed
Kimi K3.1 Pro builds on the existing Kimi K3 architecture. Developers kept the strong coding foundation while scrubbing advanced offensive cybersecurity material. A Highspeed variant is already available and reportedly runs two to three times faster than the standard release. Full open weights are scheduled for November 4. Once those weights appear, anyone can inspect, fine-tune, or host the model themselves.
Open weights create an interesting tension. Transparency lets researchers study safety techniques. It also lets others attempt to restore the missing capabilities. When someone asked Buterin whether rival labs would simply build the unrestricted versions anyway, he answered without hesitation: yes, of course they will. The point of the current limit is not permanent prohibition. It is buying calendar time.
The Darker Path Buterin Fears
If AI-assisted attacks start causing serious damage, the political and corporate response could be swift and heavy-handed. Buterin sketched a future of locked-down models, mandatory Know Your Customer procedures, and intrusive surveillance. Access to advanced tools might then depend on citizenship, verified identity documents, or other credentials. Some people would become second-class, third-class, or even fourth-class participants based on paperwork rather than ability.
That scenario feels uncomfortably plausible. After every major security incident, the instinct is to tighten controls. In the crypto world we have already watched exchanges and platforms layer on ever more identity requirements. Extending the same logic to AI usage is only a short step. Once identity becomes the gatekeeper for powerful models, the door to broader monitoring swings open.
Perhaps the most interesting aspect is how consistent this warning is with Buterin’s own recent experiments. In mid-October he described a privacy-focused setup that routes traffic through Tor, uses anonymous payment methods, and rewrites prompts locally before they reach external models. The goal is straightforward: let people use AI services while revealing as little personal information as possible. That kind of practical privacy work only becomes more urgent if identity checks become the default path.
Earlier Warnings About AI Cyber Capabilities
Independent testing has already shown that earlier versions of Kimi could attempt offensive operations. In July researchers from the U.S. Center for AI Standards and Innovation and the United Kingdom’s AI Security Institute put Kimi K3 through simulated corporate-network attacks. The model completed an average of 17 steps out of 32. The strongest U.S. systems tested reached 28.5 steps. Existing safeguards slowed it down but did not eliminate the risk.
Those results covered the previous release, not the new K3.1 Pro. Still, they illustrate why deliberate filtering feels necessary to some developers. The models are already capable enough to worry specialists. Giving them unrestricted training data on exploit techniques only accelerates the problem.
Why Formal Verification Keeps Coming Up
Buterin has returned to formal verification repeatedly. In May he highlighted its potential across Ethereum’s zero-knowledge virtual machines, cryptographic proofs, consensus systems, and research into quantum-resistant methods. The same logic applies outside blockchain. If defenders can prove properties about code before it ships, the advantage of rapid AI-driven probing shrinks.
In September he pushed back against the idea that AI hacking would make cybersecurity permanently unwinnable. Automated verification, he argued, could improve the defender’s position. That optimism only holds if the community actually invests the time and talent required. Capability limits on the offensive side create space for that investment to catch up.
In my experience, software teams already struggle to keep up with ordinary vulnerability reports. Adding AI-powered attackers into the mix without corresponding defensive advances looks reckless. Slowing one side of the arms race, even temporarily and selectively, is a rational move.
Open Weights and the Transparency Trade-Off
Moonshot’s plan to release full weights by early November raises classic open-source questions. Transparency lets independent researchers audit safety claims and experiment with new guardrails. It also lowers the barrier for anyone who wants to reintroduce the filtered material. Buterin accepts that reality. The decision is not about forever locking capabilities away. It is about sequencing: give the world a window to improve baseline security before the next leap in offensive power arrives.
This approach differs from pure closed models that hide everything behind APIs. Open weights invite scrutiny. They also invite misuse. Navigating that tension honestly seems more useful than pretending the problem does not exist.
What This Means for Blockchain and Crypto Projects
Blockchain developers sit at a particular intersection of these risks. Smart contracts, bridges, and custody systems have already lost billions to conventional hacks. AI tools that can analyze bytecode, generate novel exploits, or probe economic incentives at scale raise the stakes further. Directing more AI assistance toward security testing and mathematical verification, as Buterin has suggested, becomes practical self-defense.
Projects that treat formal methods as optional research rather than core engineering will face growing pressure. The same applies to older codebases still securing real value. The window Buterin describes is not infinite. Once unrestricted models become widely available, the cost of delayed hardening rises sharply.
- Review legacy smart contracts and off-chain components for known classes of vulnerability
- Invest in formal verification tooling for new critical code
- Treat AI-assisted red-teaming as a continuous practice rather than a one-time exercise
- Plan for a future in which advanced AI access may carry heavier identity requirements
These steps sound obvious on paper. Executing them under time pressure is harder. Capability limits on selected models buy a little more calendar time to get the work done.
The Broader Philosophical Choice
At root this debate is about two different ways of managing risk. One path restricts what models are allowed to know and do. The other path restricts which humans are allowed to use the models. Buterin clearly prefers the first. Use-case discrimination still leaves the technology broadly available. User discrimination creates permanent hierarchies based on identity and jurisdiction.
I’ve watched similar choices play out in other areas of technology. When platforms respond to abuse by demanding more personal data, the long-term cost often exceeds the short-term gain in safety. Once identity infrastructure is built, it tends to expand. Privacy-preserving alternatives become harder to maintain. Starting with capability limits keeps more options open for ordinary users.
That does not mean every lab will follow Moonshot’s example. Competitive pressure remains intense. Some organizations will train on everything they can obtain. Others may adopt similar filters for reputational or regulatory reasons. The existence of at least one high-performing open model that deliberately omits the most dangerous material creates a useful reference point.
Practical Steps Individuals Can Consider
Most readers will never train frontier models. Still, the same principles apply at smaller scale. When evaluating any AI tool, ask what it refuses to do and why. Tools that openly discuss their safety boundaries tend to be more trustworthy than those that claim unlimited power. Privacy-focused setups that minimize identity leakage remain worth exploring, especially as regulatory pressure grows.
For developers working on blockchain systems the message is clearer. Treat formal verification and rigorous testing as first-class work, not afterthoughts. Assume that stronger offensive AI will appear regardless of any single company’s choices. Use the current window to reduce the attack surface of everything that already holds value.
Looking Ahead to Open Weights and Beyond
November 4 will mark a concrete milestone when Kimi K3.1 Pro weights become available. Researchers will examine the filters. Others will attempt to reverse them. The public conversation about responsible capability limits will gain new data points. Whether more labs adopt similar approaches remains an open question.
Buterin’s intervention does not claim to solve the larger alignment or safety problem. It simply argues for a practical priority: buy time by limiting the most dangerous use cases before society is forced into restricting users themselves. That framing feels grounded and useful. It avoids both naive optimism and pure fatalism.
In the end the choice is less about any single model and more about the kind of future we prefer. One path leads toward tools that are broadly available yet carefully scoped. The other leads toward powerful systems locked behind identity gates and surveillance layers. Preferring the first path does not require believing that capability limits are permanent or perfect. It only requires recognizing that the alternative carries its own heavy costs.
The conversation Buterin started this week will not end with one blog post or one model release. As AI systems continue to improve, the pressure to respond to security incidents will only grow. How that response is structured will shape access, privacy, and innovation for years. Choosing to discriminate against dangerous use cases rather than against ordinary users remains, for now, the less damaging option. Whether enough of the industry agrees is a question the next few years will answer.
