Kimi K3.1 Pro and the arithmetic of "open"
Moonshot released full weights for Kimi K3.1 Pro on Hugging Face on November 5, 2026: a 2.8-trillion-parameter mixture-of-experts model, quantization-aware trained to MXFP4, about 1.56 TB across 96 shards. The license that ships with it — the Kimi K3.1-Pro License, distinct from the K3 license — is a plain MIT-style grant wrapped around two revenue-triggered conditions. Read it carefully and you can see where "open" is going.
The grant is broad. The opening clause is nearly verbatim MIT: use, copy, modify, merge, publish, distribute, sublicense, sell, fine-tune, build derivatives. On paper this is more permissive than most "open-weight" AI licenses, which typically fence off competition with the licensor.
Then the conditions arrive, and they are measured in dollars.
1. Model as a Service above $20M. If you or your affiliates operate a Model-as-a-Service business and aggregate twelve-month revenue exceeds $20 million (USD equivalent), you must sign a separate agreement with Moonshot before any commercial use of the weights or derivatives. The license defines MaaS narrowly — giving third parties inference or fine-tuning access where they control inputs, parameters, or training data — and it explicitly exempts end-user products with embedded capabilities and mere relaying.
2. Attribution above scale. If the weights (or derivatives) power a commercial product with more than 100 million monthly active users, or more than $20 million in monthly revenue, "Kimi K3.1-Pro" must be prominently displayed on the product's user interface.
Both conditions vanish for internal use and for anything accessed through Moonshot's own products or certified inference partners.
This is the new shape of openness. The license does not ask what you do with the model — it asks how big you are. Openness here is a graduated tax regime: free below the thresholds, a negotiated contract for the biggest model resellers, and a branding obligation for the biggest products. The old open-source licenses drew their lines around conduct (copyleft, no discrimination). These draw the line around headcount and revenue. A fifteen-person startup and a three-person research lab are equally "open"; a hyperscaler is not open at all until a lawyer says so.
How is it enforced? That is the honest weakness, and it is worth spelling out.
- The trigger is self-assessment. Nothing in the license creates a reporting duty. Moonshot does not know your twelve-month revenue unless you tell them, and the license does not oblige you to. The $20M MaaS threshold relies on the licensee reading the license and coming forward to negotiate. Realistically, that means the condition binds the companies who care about their license hygiene — enterprises, funded startups, anyone whose lawyers touch procurement — and is silent about everyone else.
- Attribution is visible, at least. A product serving 100M MAU that fails to display "Kimi K3.1-Pro" is publicly observable. This clause is the only one with an external, checkable signal. Even so, checking it requires someone at Moonshot to look.
- Copyright, not just contract. The license is styled as a copyright permission (MIT-derived), so breach of its conditions is, at minimum, termination of the copyright license — meaning continued use becomes infringement. Moonshot can also pursue contract claims where a signed agreement exists. But detection remains the bottleneck: for self-hosted, fine-tuned, private deployments, there is no telemetry and no audit right. Nobody is watching your GPU cluster.
- Distribution chokepoints do some work. Hugging Face hosting means the canonical copy is gated by nothing but a click, but derivative redistribution (a fine-tune published under a different name, a quantization dropped to another registry) has no provenance enforcement. The cyber-removal decision — Moonshot stripped cybersecurity training data from mid-training and RL before the open release — shows the practical enforcement posture: control what you ship in the first place, because you cannot control what happens after.
Compare this with the mechanisms that made the GPL enforceable: source availability, network-triggered obligations (AGPL), and a community that policed violations because the violation was visible in the binary. Model licenses have none of those levers. The weights are the source, they are public, and once they leave the repository they are effectively unpoliceable. Revenue-triggered conditions are therefore less like licenses and more like pre-negotiated commercial terms with a legal tripwire — effective against actors who fear litigation, inert against those who don't.
That is not a reason to call it closed. Full weights, no usage restrictions, sellable derivatives — the grant is genuinely generous, and more generous than K3's. But it is a reason to be precise about the word "open." Openness is no longer a binary declared by a license text; it is a curve, parameterized by your revenue and your user count, with the terms getting worse the bigger you get. When a license conditions its own generosity on the size of the licensee, "open" has stopped describing the artifact and started describing a relationship between the artifact and your balance sheet.
Adapted from the draft opening chapter of But Is It Open?