Kimi K3 Open Weights: Benchmarks, Licence, and What It Takes to Run 2.8T Parameters

Moonshot AI released the weights for Kimi K3 on July 27, eleven days after the API launch. At 2.8 trillion parameters it is the largest open model I am aware of, and Artificial Analysis ranked it third overall when it launched, behind only Claude Fable 5 and GPT-5.6 Sol.

The headline is that a downloadable model now sits near the frontier. That is true, and it needs two qualifications: "open" comes with a licence you should read, and "downloadable" is a long way from "runnable".

I have not run K3 myself. What follows is my reading of the published numbers.

Kimi K3 specifications

Specification	Kimi K3
Total parameters	2.8T
Active parameters	104B
Experts	896 total, 16 selected per token, 2 shared
Layers	93
Context	1,048,576 tokens
Weights on disk	96 shards, 1.56 TB
API price per million tokens	$0.30 cached, $3 input, $15 output
Licence	Kimi K3 License

Sources: model card, Kimi blog.

The same warning applies here as with every large mixture-of-experts model. The 104B active figure describes compute per token. All 2.8T parameters still have to be stored and served.

Thinking is always enabled, with effort set to low, high or max, and max is the default. Long sessions will carry that reasoning cost, so test it with your own workloads.

Independent benchmarks

The most useful numbers come from outside Moonshot. Artificial Analysis tested K3 through the API at launch and published its results on July 17, before the weights were released.

Measure	Kimi K3	Comparison
Intelligence Index	57, rank 3	GLM-5.2 51, DeepSeek V4 Pro 44
Cost per Index task	$0.94	GPT-5.6 Sol $1.04, Opus 4.8 $1.80, GLM-5.2 $0.32, DeepSeek V4 Pro $0.04
AA-Omniscience accuracy	46%	Kimi K2.6: 33%
AA-Omniscience hallucination rate	51%	Kimi K2.6: 39%

Source: Artificial Analysis, July 17, 2026.

The last row is the one I would not skip. K3 answers more questions correctly, and it also makes up more answers when it should abstain. Artificial Analysis calls the rise a regression, although its overall AA-Omniscience Index still improved, from +6 to +18. For retrieval and analysis workloads, where a confident wrong answer is the worst outcome, that needs testing before adoption.

Moonshot's own results are strong, and they come with the usual caveats. K3 scores 88.3 on Terminal-Bench 2.1 and 67.5 on DeepSWE, both in its own Kimi Code harness. Those scores are vendor-reported and depend on the harness, so I would not line them up with a score achieved elsewhere.

K3's cyber capability, measured by governments

On July 23, the UK AI Security Institute and the US Center for AI Standards and Innovation published a preliminary joint assessment.

ExploitBench: K3 scored 32%, against 24% for GLM-5.2. It reached arbitrary code execution on 0 of 41 tasks, where the most cyber-capable models averaged 20 of 41.
The Last Ones, a 32-step simulated network attack: K3 reached step 17 on average, against 28.5 for the leading US models and 11 for GLM-5.2. It finished in 1 of 10 attempts.

The authors conclude K3 beats GLM-5.2, which they call the most cyber-capable open-weight model as of June 2026, and sits significantly below the frontier. They also note that its safeguards did not stop it attempting exploit development, that the test set was small, and that the simulated range has no active defenders.

Timing makes this interesting. After Hugging Face used an open-weight model for its forensics because hosted models refused the work, open weights look like a tool for defenders as well as a risk. A safeguard on a downloaded model is only as durable as the person running it, and that cuts both ways.

Is Kimi K3 really open?

Various summaries describe it as MIT-like. The licence file is its own document, and you should read that instead.

Situation	Requirement
Internal use, meaning the software, its outputs and its capabilities are not made available to third parties	Exempt from the commercial conditions below
Model-as-a-Service operator, where the company and its affiliates exceed $20M revenue over any 12 months	Separate agreement required before commercial use
Product above 100M monthly active users or $20M monthly revenue	Attribution in the user interface

For most companies that is generous. If you sell AI features inside a product, section 2 excludes end-user products with capabilities solely embedded in specific features, but have your lawyers check that you fit, because that boundary decides whether you are a Model-as-a-Service operator. I am an engineer, not a lawyer.

What it takes to self-host Kimi K3

This is where the story changes.

Reported setup	Source	Status
8x B300 or 8x MI355X: the easiest route	vLLM	Vendor-reported
16x B200 or GB200: stated minimum on that hardware generation	vLLM	Vendor-reported
Supernodes of 64 or more accelerators	Moonshot recommendation	Vendor-reported
16x H200 on SGLang, 102.75 GB per GPU	One community report	Worked; a vLLM branch failed

That community report gives a rare data point: 16.8 tokens per second at concurrency 1, on low effort, generating 512 tokens. vLLM and Inferact report 118 tokens per second on GB300, or 370 with DSpark, in batch 1. Those two results differ in hardware and workload, so please do not compare them directly.

Here is a calculation of my own. At 16.8 tokens per second, a single stream running all day produces about 1.45 million output tokens. At $15 per million through the API, that is about $22 of output a day. Sixteen H200s cost far more than that to own or rent, so self-hosting only starts to make sense through concurrency. The same report reached about 147 tokens per second at 54 concurrent requests, still scaling, which is about 12.7 million tokens a day, or about $190 of output at API prices. Measure at what load your own break-even arrives.

Caching changes the picture as well. Moonshot claims over 90% cache hits in coding workloads. That is a property of its own serving fleet, and vLLM has prefix caching off by default. A self-hoster should not assume that number, or the input pricing it implies.

Who should actually self-host K3?

For most teams, the honest answer is nobody. Use the API, or a smaller open model.

The exception is when the data cannot leave. The Verifiable AI Analyst I am building is a sovereign-data proof of concept for a Saudi digital-services company, and in that kind of engagement the question of where inference runs can be settled before any model is compared. Regional hosting requirements and sector rules can rule out an API regardless of price. In such cases, an open model at this level widens the options.

I would add that the most capable model is rarely the first thing a governed system needs. In that design the model plans and explains, while a deterministic engine does all computation. A smaller model that does those two jobs well, on hardware you can afford, usually beats a giant you can barely serve.

My assessment of Kimi K3

K3 moves the frontier of what is downloadable, and the independent results support that. Teams should test it through the API, with a focus on hallucination in their own workloads, because K2.6 to K3 went the wrong way on that measure.

Treat self-hosting as a separate decision, and start it with the cost of serving, the licence and your data constraints. A 1.56 TB download takes an afternoon. Running it well is a project for a platform team.

Sources

Written by Eslam Hamed, a Technical Lead and AI Solutions Architect working on enterprise RAG, agentic AI, and cloud-based software systems.