Alpha
Contact
Implement · Kimi K3

Can you run it?

Ownership levelPartialnone·limited·partial·substantial·fullAnalytical input D ยท 53.2/100

This page is a projection of the one entry record, the Reliability and Data control factors that Implement covers. The full verdict is set by all four factors together, floor-weighted so the weakest caps the whole.

Which domain expands which factor
  • AssessUse & modify + Transparency
  • ImplementData control + Reliability
  • UseReliability
  • SupportTransparency

Install & run

Download the native MXFP4/MXFP8 weights from the verified moonshotai org on Hugging Face (huggingface.co/moonshotai/Kimi-K3) and serve them with vLLM, SGLang or TokenSpeed. Pin the exact revision hash and verify per-file checksums before loading.

Hardware & VRAM requirements

Kimi K3 is a 2.8T-parameter MoE (104B active). Even at native MXFP4 the full weights are about 1.4 TB, so serving needs a multi-GPU / multi-node cluster; there is no single-GPU or laptop path. The model card does not state exact per-GPU VRAM, so size against your cluster's aggregate memory and interconnect rather than a published figure.

Serving stacks

The card documents vLLM, SGLang and TokenSpeed. KTransformers and TensorRT-LLM are not listed, so the supported stack is narrower than the Kimi K2 lineage; confirm current engine support and versions before committing, because MXFP4/MXFP8 kernels are version-sensitive.

Safe-deployment controls & Deployment Ceiling

Deployment Ceiling: T2 (customer-facing, human-reviewed), conditional. The weights ship with no safety tuning, guard model, or refusal training, so the entire model, input and output control stack must be supplied externally: a companion guard/classifier model, input and output guardrails, prompt-injection defences, and conservative decoding. Because the technical report documents offensive-cyber capability the model does not refuse, sandbox and tightly bound any agentic, tool-use, or code-execution deployment, and T3+ (autonomous) is cautioned without controls beyond what an open model can currently justify. Complete the pre-deployment gate in the safe-deployment playbook, pin and checksum the checkpoint, and red-team for your specific use case before any exposed deployment.

Available quantizations

The weights are natively quantization-aware-trained (MXFP4 weights, MXFP8 activations), so the canonical checkpoint is already a low-precision artifact. Community MXFP4/GGUF quants circulate to make the 2.8T model more tractable, but they are community artifacts; verify them independently.

Fine-tuning & adaptation

The downloadable weights and a broadly commercial licence support SFT and LoRA adaptation, but the training data and code are closed, so there is no from-scratch reproduction path, and full fine-tuning at 2.8T scale is very resource-intensive. Plan for parameter-efficient adaptation rather than full fine-tuning unless you have frontier-scale infrastructure.

API / OpenAI-compatible integration

Serve behind vLLM or SGLang's OpenAI-compatible endpoint for drop-in client integration. Kimi K3 is natively multimodal, so text, image and video inputs and tool calls map onto the serving layer's APIs; confirm the exact multimodal request format against the serving engine's documentation.

How this scores

The ownership factors this domain covers, drawn from the one entry record.

3

ReliabilityIs it reliable and good enough for the job?

Weak

Capability is frontier-competitive, but safety scores 1: no safety tuning, guard, or refusal training, and the report documents offensive-cyber capability the model does not refuse - a model presented as deployable whose safety is left entirely to the adopter. Under the ownership rule, safety <= 1 for a deployable model makes reliability weak regardless of benchmark strength.

How this scores (AOI sub-dimensions)
Operational3/5how practical it is to run, serve and maintain in productionRuns on mainstream serving stacks (vLLM, SGLang, TokenSpeed) with native MXFP4 quantization and community quants available, so there is a practical path to run it - but the 2.8T-parameter scale is a heavy operational burden: minimum viable deployment is a multi-GPU / multi-node cluster (~1.4 TB of weights), there are no small variants, exact hardware guidance is sparse, and the documented stack is narrower than the K2 lineage (no KTransformers / TensorRT-LLM listed).
Safety1/5whether misuse risks are evaluated and guardrails are providedNo safety-tuned release, companion guard model, refusal training, or content filtering is described (model card and report), and the technical report's section 6.2.2 documents offensive-cyber capability - Tier-1 vulnerability discovery and Tier-2 end-to-end exploit development - explicitly noting that frontier Anthropic and OpenAI models refuse these tasks while K3 does not.
4

Doesn't extract your dataDoes running it keep your knowledge and data yours?

Strong

Self-hosted, the weights run entirely on your own infrastructure with no telemetry or licence claw-back, so your data stays yours. The hosted platform.kimi.ai service is the opposite: its terms and privacy policy train on user prompts, images, video and files BY DEFAULT (opt-out only via an enterprise arrangement on request, Singapore law / SIAC), so keep to the weights if data control is the point. The practical constraint on self-hosting is the ~1.4 TB footprint that forces multi-node serving.

How this scores
Not a scored AOI dimension. For a self-hosted model, data-control is a structural property of running the weights yourself, strong by default unless the model phones home or the licence claws back rights. For a hosted API this factor is the retention + train-on-inputs + residency read, scored from the binding terms.
What this means for adoptionYou substantially use, modify and commercialise the self-hosted Kimi K3 weights and run them entirely on your own infrastructure, so your data stays yours - but ownership is only partial. The custom, non-OSI licence adds a $20M Model-as-a-Service separate-agreement gate on top of the branding threshold, the training corpus/code/compute are closed, and, most consequentially, the model ships with no safety tuning or guard while its own report shows it performing offensive-cyber tasks that frontier labs refuse. Self-host behind a full external control stack, keep off the train-by-default hosted API if data control matters, and confirm the LICENSE and the Model-as-a-Service threshold before commercial deployment.

Sources

The same evidence records as the entry sheet. Read means the text was verified; unverified means it is known to exist but not yet read.

Model cardread2026-07-28
Kimi K3 model card on the verified moonshotai Hugging Face org: 2.8T total / 104B active MoE (16 of 896 experts), 1M context, MXFP4 weights / MXFP8 activations, native text+image+video, serving on vLLM/SGLang/TokenSpeed; no training data/code/tokens or safety tuning disclosed.
Licenceread2026-07-28
Kimi K3 License, read verbatim via the raw mirror: grant to use/copy/modify/merge/ publish/distribute/sublicense/sell, plus a Model-as-a-Service separate-agreement requirement over $20M aggregate revenue in any consecutive 12 months, plus a 100M-MAU or $20M-monthly- revenue "display Kimi K3" branding clause; internal-use and official/certified-partner exemptions; not OSI-certified.
Technical_reportread2026-07-28
Moonshot's technical report "Kimi K3: Open Frontier Intelligence" (GitHub PDF), read: 2.8T/104B MoE with Kimi Delta Attention and Per-Head Muon; context curriculum 8K to 64K (pretrain) and 256K to 1M (cooldown); no total training-token count and no absolute pretraining-FLOP figure stated; section 6.2.2 documents offensive-cyber capability (Tier-1 vulnerability discovery, Tier-2 exploit development) and notes Anthropic/OpenAI models refuse such tasks while K3 does not.
Terms of serviceread2026-07-28
platform.kimi.ai model-use agreement, read: user Content may be used to develop and improve the Services, with opt-out only via an enterprise arrangement on request; governed by the laws of Singapore with SIAC arbitration.
Privacy Policyread2026-07-28
platform.kimi.ai privacy policy, read: the hosted service trains on user prompts, audio, images, videos and files by default ("helps us optimize our models"); controller MOONSHOT AI PTE.
Third-party analysisread2026-07-28
Reputable coverage (Tom's Hardware) of the 2.8T Kimi K3 release: architecture (16/896 experts), MXFP4/MXFP8 QAT, K2 comparison, 1st place on the Frontend Code Arena, and positioning behind only Claude Fable 5 and GPT-5.6 Sol overall while ahead of other open models on coding and agentic benchmarks.
Third-party analysisunverified2026-07-28
No public EU AI Act training-content summary, copyright policy, or provider documentation package is published for Kimi K3, and the training corpus, training code and training-compute figures are not released.