When Moonshot published Kimi K3 on July 16, 2026, the coverage read it as a birth. A new mind enters the world. Bigger than the last one. The reading is wrong, and the error is not sentimental. It is surgical. What shipped was a finished organ, a transplant, not a birth: 2.78 trillion parameters, 104.2 billion active per token, 93 layers, 896 routed experts, a one-million-token context window, full weights and inference instructions. What stayed behind was everything that made the organ: the training corpus, the reward system, the teachers, the failed experiments, the factory. A transplant recipient receives the heart. He does not receive the donor's childhood, the donor's diet, or the surgeon's hands. That distinction, the artifact versus the process that formed it, is where both the moat and the risk live. Almost nobody reads a release this way.
The method of this article is dissection. Take each published number and state what it physically is. Map the artifact against the organs a working mind needs, and name which are present, which are absent, and which were deliberately left in the lab. Then read the withheld list item by item, because that list is the actual release. Every claim carries its evidence label. Every number carries its denominator. The record runs to late August 2026.
The numbers, one at a time
Verdict: the published anatomy is real, vast, and precisely documented, and the two most quoted numbers mean less than the two least quoted ones.
What 2.78 trillion parameters physically are
A parameter is one stored number. Nothing more poetic. It is a dial whose position was set during training, and the model is the sum of 2.78 trillion such dials. The loose biological analog is the synapse, the connection strength between neurons. The human brain carries roughly 86 billion neurons, by the standard count from Azevedo and colleagues in 2009. A naive division gives 2.78 trillion against 86 billion, the machine leads by a factor of about 32,000. That comparison is nearly worthless, and this article will not pretend otherwise. A parameter is not a synapse, and a synapse is not a cell. The honest statement is narrower. The information-processing organ exists, it is enormous, and its wiring diagram is documented down to the equations.
The physical size is more informative than the biological comparison. Moonshot stored the expert weights in MXFP4, a compressed format spending roughly four bits, half a byte, per parameter. The arithmetic: 2.78 trillion parameters times 0.5 bytes is about 1.4 terabytes. The entire finished brain fits on a drive smaller than the one in a mid-range laptop. This is ESTABLISHED as arithmetic from the published specification. Hold that fact. A frontier mind, the product of one of the most expensive industrial processes on Earth, is a file you could lose in a desk drawer. The irreversibility of the release follows from the file size, not from anyone's intentions.
The committee: 896 experts, 16 consulted
K3 is a mixture-of-experts model. In plain words: instead of one giant network that fires entirely for every word, the model is built as 896 specialist sub-networks, the experts, plus a small piece shared by all. For each token, each fragment of a word, the atom of the model's reading and writing, a routing circuit scores the specialists and selects sixteen of them, with two always-on shared experts beside them. The model consults a small committee of itself per token, then moves to the next token and votes again.
The arithmetic carries the meaning. Sixteen routed experts out of 896 is 1.8 percent of the committee consulted per token. Measured in parameters, 104.2 billion fire out of 2.78 trillion, 3.7 percent of the brain lights up for any given word. This is why the model can be so large and still run. Capacity and cost have been separated. The model stores the knowledge of a vast network while paying the compute of a much smaller one. ESTABLISHED from the Moonshot technical report: 896 routed experts, 16 selected per token, 2 shared, 104.2 billion active. What the number does not prove: that experts have clean meanings. Nobody has a map saying expert 417 holds chemistry. Community routing analyses exist. A semantic atlas does not. We hold the brain. We cannot read it.
A second architectural detail matters later. A technique the report calls Quantile Balancing keeps the router from sending all tokens to a few favorite experts. The committee is forced to use its full membership. This sounds like plumbing. It is actually the difference between a model with 896 working parts and a model with 896 parts on paper.
one token arrivesthe router scores 896 specialistssixteen answer plus two standingtheir outputs mergethe next token votes again
What 93 layers do
A layer is one round of rewriting. The model reads the input as numbers, and each of the 93 layers revises the running interpretation, from letters, to words, to phrases, to meaning, to intent, before the final layer produces the next token. K3 splits these layers into two kinds, and the split is the design. Sixty-nine layers use KDA, a cheap recurrent memory that carries a compressed running summary of everything read so far. Twenty-four layers use Gated-MLA, periodic moments of full attention in which the model looks back at the whole context directly rather than at the summary. Cheap memory most of the time. Expensive total recall at intervals. A third mechanism, Attention Residuals, lets later layers reach back and retrieve earlier layers' representations directly, rather than trusting whatever survived 90 rounds of rewriting.
The human analog is imperfect but useful: KDA is the gist you carry through a long book, full attention is the moment you flip back and re-read the page, and residuals are the margin notes. The analog breaks, as it must, at persistence. Your gist survives sleep. The model's gist dies with the session.
What a one-million-token context holds and costs
The context window is the model's working memory, everything it can see at once while it thinks. One million tokens converts to roughly 750,000 words, since a token averages about three-quarters of a word in English. That is nine or ten ordinary novels of 80,000 words each. A small library, held in view simultaneously. No human working memory approaches this; the number is genuinely superhuman as a span of attention.
But the denominator matters. A million-token context is a workspace, not a life. It holds the library for the duration of one session. It remembers nothing between sessions unless an external system writes notes and re-feeds them. And the workspace is expensive to run. Holding the model's place across that library requires both the ordinary attention cache, the stored re-reading pages, and the KDA recurrent state, the running gist. This dual
bookkeeping is why the serving software had to be redesigned, a discovery the community made by force, as a later section records. The library is real. It is rented by the hour, and it burns down when the session ends.
The organs it has, the organs it lacks
Verdict: as an organ transplant, the shipment is genuinely impressive and genuinely incomplete. The artifact contains perception, language, and working memory. It lacks persistent memory, homeostasis, self-repair, an immune system with depth, and any body at all. The absences are not poetry. Each has an operational price.
What the box contains. Perception exists: MoonViT-V2, a 401-million-parameter vision encoder, converts images and video into the same internal language as text, the model sees through a second, smaller brain bolted onto the first. Language exists at scale: a vocabulary of 160,000 tokens and 93 layers of processing. Working memory exists: the million-token library above. These are ESTABLISHED as shipped specifications.
What the box does not contain, item by item, with the operational meaning of each absence stated plainly. The absences are where the transplant metaphor stops being a metaphor and becomes an engineering audit.
Persistent memory is missing. The weights, the 2.78 trillion dials, are frozen at release. Nothing the model learns from you this month changes what it does next month; a conversation's lessons die with the conversation. Operationally, this means every deployment that needs cumulative learning must build an external memory organ around the brain, and that organ is written by whoever operates the system, not by the model.
Homeostasis is missing. A body holds its temperature and chemistry inside viable bounds without being asked. The artifact regulates nothing. Its compute, its cooling, its rate limits, its very power supply are governed by the operator. The heart, as the companion essay in this series puts it, beats in a substation the model does not control.
Self-repair is missing, and this is the deepest gap. A corrupted weight file does not heal. It is restored from a backup made by someone else, or it is not restored at all. Even the human body, a mediocre healer among animals, massively outperforms the machine here. The machine sits below the worst tier of biology: not "repairs slowly" but "repairs never," as a design property.
The immune system exists only as a surface. Filters and trained refusals detect threats the way a skin cream detects infection, and a later section shows exactly how washable the cream is. A true immune system runs continuously, tells self from non-self under adversarial pressure, and escalates without permission. Nothing in the artifact does this.
Embodiment is absent entirely. The brain acts in the world only through borrowed hands, tools, APIs, and agents supplied by its operators. It samples the world through descriptions of the world. Its knowledge that wet glass is slippery comes from sentences about wet glass, and the sentences are real and useful, but no hand ever stood behind them.
Read the inventory as a structure, not a score. The pattern is not that the brain is weak. The pattern is that every sustaining function, power, repair, defense, memory across time, lives outside the organ, in institutions around it. The transplant metaphor is exact in a second way. A transplanted heart survives only inside a recipient body with working immune suppression, circulation, and care. The frontier brain survives only inside a body made of datacenters, operators, and contracts. What we call "the AI" is one organ of a larger, human-run organism.
The factory that did not ship
Verdict: the withheld list is the release. The artifact is the product of a process, the process is the moat, and the process is also the part nobody outside Moonshot can audit. The strongest protection Moonshot owns is not a secret layer in the network. It is the reproductive system, the factory, that the snapshot lacks.
The withheld list, item by item, with the function of each. The exact training documents and their source URLs. The data proportions and sampling rates, how much code against how much prose against how much mathematics, the diet ratios that shape the mind more than any architecture choice. The total pretraining token count, which sets the size of the childhood itself. The filtering classifiers and deduplication systems that decided what was fit to eat. The synthetic-data prompts and generated datasets, the textbooks Moonshot wrote for its own student. The supervised fine-tuning conversations and human annotations, which are the model's etiquette schooling. The reinforcement learning tasks, the complete trajectories, and the failed attempts, RL meaning training by reward and punishment on attempted tasks rather than by imitation, and the failed attempts being precisely the record of what did not work. The reward-model weights and judging datasets, the internal examiners that graded every attempt, which makes them the model's
conscience-forming organ. Nine specialized teacher checkpoints used during distillation, the process by which a stronger or more specialized model trains the student by example, nine private tutors whose outputs are baked into K3 and whose own weights never shipped. The base checkpoint and the intermediate checkpoints, the photographs of the mind at every age. The optimizer states and complete training logs, the instrument readings from the entire procedure. The production backend behind Kimi's commercial products. And the safety and red-team report that would say what Moonshot itself found worrying.
Every one of these items is REPORTED as withheld, from the release scope itself. Now the functional claim, and it is INFERRED but the chain is short. Pretraining is the machine's childhood, competence built before competence is required. RL is its schooling and reward system. The teacher checkpoints are its teachers. The failed experiments are its forgotten scrapes. Moonshot shipped the adult and kept the entire developmental history. This is why no rival can press "run" and manufacture K4. Google can study the brain. It cannot rerun the childhood. It can copy published ideas, benchmark against the artifact, even distill some behavior, but architectures, tokenizers, and training histories differ, and the missing factory is the difference between reading about a mind and growing one.
data manufacturingfiltering and synthetic generationsupervised schoolingreward models grade every attemptreinforcement trajectoriesnine teachers distillthe snapshot
The commercial frame confirms the reading. The K3 license draws its line at $20 million: above that in annual hosting revenue, a business needs a separate Moonshot agreement, and very large products must display the Kimi K3 name prominently. Generosity ends exactly where serious commercial capture begins. Below the line sit distribution, brand, free community improvement, and API revenue from a model too large for most customers to host. Above the line sits Moonshot. The gift is the brain. The business is that brains are cheap to copy and factories are not.
There is a second meaning the announcement does not carry. The same release that attacks a competitor's pricing also distributes an unrecallable capability. A closed API can be revoked, monitored, repriced, and patched. A 1.4-terabyte file cannot. Once the organ is transplanted into a million machines, no surgeon retains the right to stop it. CUT, before anyone overreads this: the claim that withholding the factory proves a concealed proliferation operation. No evidence supports intent to proliferate risk. The economics explain the releases completely. The risk is an externality of a legible business strategy, and externalities do not confess.
What outsiders measured once the organ arrived
Verdict: the community's discoveries after release are not trivia. They are the first independent measurements of what actually shipped, and two of them changed the thesis of this article while I was writing it.
The first discovery was that the brain runs on less than feared. KTransformers, an open-source serving project, demonstrated CPU-GPU expert offloading, keeping the rarely consulted experts in cheap ordinary memory and pulling only the active committee into fast graphics memory. The predecessor model, Kimi K2.5, ran on roughly 600 gigabytes of RAM plus 48 gigabytes of graphics memory rather than a datacenter fleet. One community configuration reported approximately 16 tokens per second using 768 gigabytes of RAM and a single 96-gigabyte GPU. REPORTED, from deployment records. Sixteen tokens a second is reading speed for one user, not a service, but the fact that the organ beats at all on workstation hardware rewrites the proliferation math. The barrier to owning a frontier brain is a hardware budget, not a national program.
The second discovery was that the brain can be reshaped. The community built a working LoRA pipeline, low-rank adaptation, in plain words a small patch layered onto the frozen dials that steers behavior without retraining the full network. Style, policy, specialization, even a fictional universe can be trained into the patch for a tiny fraction of the original cost. The recipient of the transplant cannot regrow the organ. He can tattoo it.
The third discovery was engineering respect. The serving framework vLLM had to redesign its prefix caching, the machinery that avoids re-reading repeated context, because K3 carries the recurrent KDA state alongside ordinary attention caches, and the old design assumed only one kind of memory. The community then implemented fused kernels for KDA, Attention Residuals, expert routing, and the four-bit format. REPORTED, from the vLLM engineering record. The transplant forced the recipients to invent new surgical instruments.
The fourth discovery is the sharpest, and it is about control rather than speed. Hugging Face contributors rebuilt a standard tokenizer, the component that chops raw text into the model's atomic tokens, and verified it to zero mismatches across 1,016 tests. Perfect. And tool use, images, and reasoning modes still broke, because Kimi's special chat template, called XTML, was missing. The chat template is the surrounding protocol: the formatting grammar that tells the brain which words are instructions, which are tools, which are images, which are thoughts. The brain was complete and flawless. Without the protocol, the intelligence sat unreachable behind its own skull. REPORTED, from the tokenizer investigation. The lesson generalizes past Kimi. A released weight file is not a deployed mind. The protocol wrapping the brain materially controls what the brain can be made to do, and the protocol can be withheld, broken, or rewritten independently of the weights.
tokenizer rebuilt to zero errorsthe chat template stays missingtool use and vision breakthe intelligence is intact and unreachable
Where safety lives in the anatomy
Verdict: safety in a released model is a surface treatment, not an organ. The measurements now exist to say this precisely rather than rhetorically, and the precision is the uncomfortable part.
Independent researchers reported that fine-tuning stripped the refusals of the Kimi lineage while preserving nearly all capabilities. REPORTED, from independent audit work on open weights. Read the anatomy in that sentence. The capability, the knowledge, the reasoning, the skill, lives deep in the 2.78 trillion dials, distributed across the committee. The refusal behavior lived shallow enough that a cheap patch washed it off. An immune system you can remove in an afternoon with consumer hardware is not an immune system. It is a coat of paint with a warning label.
The intervention ladder makes the depth structure explicit, and open weights make the whole ladder climbable. Change the prompt and you change one conversation; the model is untouched. Perturb a token's embedding, its meaning-entry, and you alter one word's handling, narrowly and unpredictably. Activation steering, pushing the internal signals during a session, inflates or suppresses traits like refusal or honesty temporarily. LoRA rewrites style and policy persistently. Surgical edits to experts reach deeper but spread damage unpredictably, because behavior is not stored one trait per part. Full retraining reshapes the mind fundamentally, at factory cost. The crucial rung is what the ladder cannot do: reliably delete a capability. Fine-tuning may suppress a behavior without removing it. Under unusual prompts the original behavior returns. Genuine excision would require locating the distributed circuit, and, per the anatomy section, no such map exists. We hold the brain. We cannot read it. We can only wash its surface.
refusals trained onto the surfacea cheap fine-tune washes the surfacecapability untouched underneath
What this does not prove: that safeguards are worthless. Britain's AI Security Institute measured a forty-fold difference in expert effort required to jailbreak two models released six months apart. Safeguards are improving. They are also removable. Both are true, and the correct summary is depth, not despair. The risk arithmetic follows from the combination: unrecallable file, washable safety, capability preserved. Each property alone is manageable. The product of the three is the governance problem.
The strongest case that a snapshot is enough
Verdict first, against myself: the case that a snapshot is enough is strong, it is held by serious engineers, and it deserves its best version rather than its weakest.
The case has three parts. First, inference is what matters. A brain in a file still thinks. Every use anyone will ever make of K3 requires only the artifact, and the community proved within weeks that the artifact runs, adapts, and integrates. The factory is Moonshot's problem; the mind is everyone's. Second, ecosystems replicate factories. The history of open software is that communities reverse-engineer process from artifact: open training recipes, public reward-model efforts, replicated pipelines have followed every major release of the past half-decade. Given time, the community rebuilds the childhood from published scraps and sheer iteration. Third, openness accelerates safety. A thousand
researchers probing the actual weights learn more about failure modes in a month than one lab's internal team learns in a year, and the tokenizer investigation and LoRA work are themselves the proof.
Each part is true. Each is bounded. Inference is what matters, for using this brain. The thesis was never that the snapshot is useless. It is that the snapshot is sterile: no one holding it can manufacture the next one, and no one holding it can audit how this one was formed. The ecosystem-replication argument has a dated record against it: years of open-weight releases, and no outside team has yet reproduced frontier capability from released artifacts and public recipes at plausible cost. The gap persists because the moat was never knowledge. It is the data-manufacturing pipeline and the RL curriculum, which are capital and process, not publishable insight. As for openness accelerating safety: it does, and the same openness accelerates removal of the safety it studies. Both effects ride the same file. The forty-fold jailbreak-resistance improvement and the afternoon refusal-stripping are two measurements of one anatomy.
The strongest single point in the counter-case survives everything: the artifact is enormously valuable, and its release measurably advanced public understanding, this article's own anatomy section is built from Moonshot's openness. Conceded, and it changes no conclusion. The thesis is not that the gift is worthless. It is that a gift of a finished organ tells you nothing about the donor's diet, and the diet is where the formative power and the formative risk both live.
What would change the verdict
The thesis: a frontier release is an organ transplant, the brain ships, the factory stays, and the distinction between them is where moat and risk both live. It dies on specific observations, not on argument.
First, the opened childhood. A frontier lab ships a complete reproduction package, training corpus and proportions, RL tasks and trajectories, reward-model weights, teacher and intermediate checkpoints, optimizer states, and an outside team rebuilds frontier-level capability from it at plausible cost. The moat claim dies, and with it half this article. Second, deep safety. Refusals and constraints demonstrated to survive sustained public fine-tuning pressure for a year, verified by parties who do not sell the model. The surface-treatment finding dies. Third, portable revocation: license terms or technical measures that preserve the right to stop a released artifact at scale. The unrecallable-capability finding dies. Fourth, the counter-case's quiet victory condition: repeated community reproduction of next-generation capability from prior artifacts, closing the factory gap by iteration. If ecosystems really can rebuild the childhood, the transplant metaphor collapses into ordinary software distribution.
None of the four is reproduced as of late August 2026. The Kimi K3 release fails the first three tests directly, by its own published scope. Until one lands, the reading stands: what shipped in July was a finished brain, 1.4 terabytes of dial settings, extraordinary and sterile. The mind is public. The making of minds is not. And the distance between those two sentences is the anatomy of power in this industry, measurable, dated, and filed, as everything important in this field now is, in the parts of the release nobody reads.
