1,454 GB, crawling at somewhere between 3 and 15 MB/s, with the ETA jumping from 1,487 hours to 27.6 hours and back up to 96.9 across a handful of one-minute ticks. That is the entire content of a screenshot posted on the 27th of July, 2026, by an American pulling the Kimi K3 weights down to his own storage, captioned as what escaping the permanent underclass looks like.
The number is right. The official moonshotai/Kimi-K3 repo tree on Hugging Face weighs 1.56 TB decimal, which is 1,454 GiB, so this is the full release and not a community quant. At his observed average of roughly 7.5 MB/s he was looking at about 58 hours of wall clock. On a gigabit line it is ~3.5 hours. In a datacenter with 10 Gbps it is twenty minutes. The bottleneck in that picture is not the license, not the GPU, not Washington, it is the last mile into somebody's apartment.
I bookmarked the download log and the Moonshot announcement in the same sitting, and a day later I bookmarked a completely unrelated post about a man at Atlanta airport whose phone wiped itself in front of CBP. They kept sitting next to each other in my list, and eventually I worked out why. Both are arguments about a copy sitting on hardware that a person physically owns, and about how uncomfortable that has become.
What is actually in the file
Moonshot's technical report opens by conceding the thing most launch coverage buried. Kimi K3 is a 2.8T parameter mixture-of-experts model with 104 billion activated parameters, native vision, and a 1M-token context window, and the abstract says outright that its overall performance still trails the most powerful proprietary models, namely Claude Fable 5 and GPT-5.6 Sol. The architecture is where the interesting work is: Kimi Delta Attention and Attention Residuals for information flow across sequence length and depth, and a Stable LatentMoE that activates 16 of 896 routed experts per token. That is about a 1.8 percent activation ratio, unusually sparse for the class, and Moonshot claims the whole package gives roughly 2.5x the scaling efficiency of K2.
The checkpoint is small(1.5 TB rather than the ~5.6 TB an FP16 2.8T model would need) because quantization-aware training runs from the SFT stage onward, MXFP4 weights with MXFP8 activations. The shipped artifact IS the 4-bit model, not a lossy afterthought someone bolted on later. That detail is why the download in the screenshot is even attemptable on a home connection.
Read the benchmark panel with the footnotes, not the bars. Kimi K3 leads on ProgramBench by 0.2 points over GPT-5.6 Sol, leads SWE-Marathon at 42.0, leads BrowseComp at 91.2, and sits second or third on most of the rest. A footnote states the GDPval-AA v2 numbers are Artificial Analysis figures as of the 23rd of July, 2026, and those borrowed numbers do not match what AA published on its own site, which had K3 at 1668 Elo against Fable 5 at 1760. Another footnote says all Fable 5 results are with potential fallbacks and all GPT-5.6 Sol results include potential cyberguards, which is Moonshot quietly flagging that the competitor scores may include vendor-side scaffolding. Nobody in the coverage has explained what those two words mean. Absent from the chart entirely: AA-Omniscience, where K3's accuracy improved from 33 to 46 percent while its hallucination rate climbed from 39 to about 51 percent.
The three repos nobody quoted
The last paragraph of the announcement is the part I would keep if I had to throw the rest away. Alongside the weights, Moonshot opened MoonEP, FlashKDA and AgentENV. FlashKDA was already public, MoonEP and AgentENV are new, and all of it is the machinery they used to train the thing rather than the thing itself.
MoonEP is an expert-parallel communication library whose trick is load balance under skew: every rank receives exactly S x K tokens no matter how lopsided the router gets, using redundant experts planned online from current router outputs and prefetched before expert computation. DeepSeek's DeepEP already does high-throughput all-to-all dispatch and combine, so the differentiator here is not bandwidth. FlashKDA is the CUTLASS kernel implementation of Kimi Delta Attention under MIT, with prefill benchmarked 1.72x to 2.22x faster than the flash-linear-attention baseline on H20, which is the export-restricted China SKU, and picking that as the reference hardware is itself a statement. AgentENV, done with kvcache-ai, runs agent environments at scale on Firecracker microVMs with OCI images loaded on demand through overlaybd, local disk as a bounded cache so images can exceed disk capacity, and snapshot-backed environments that boot or resume in under 50 ms and pause in under 100 ms.
Weights let you run a frontier model. Those three repos are a large chunk of what you need to train one. As far as capability transfer goes, the toolchain is the heavier package, and it is the one that got a single line at the bottom of the post.
Free until you make money
It is not MIT, and it is not the Modified MIT of K2.7-Code that most pre-release coverage predicted. The Hugging Face repo carries a custom Kimi K3 License, MIT-derived and permissive for downloading, running, modifying, fine-tuning and deploying commercially at no cost, with two conditions attached at scale. A Model-as-a-Service business above $20M revenue over any consecutive twelve months has to sign a separate agreement with Moonshot, and products above 100 million MAU or $20M a month have to display the Kimi K3 name prominently. Nathan Lambert and Kevin Xu both flagged the $20M threshold as low enough that basically every serious inference host ends up at the negotiating table.
So the license is stratified by revenue: free for the guy with the NAS, negotiated for anyone with a business. Moonshot is monetizing exactly the layer that the democratization story says is being disrupted, and doing it deliberately. Also worth being precise about the word open here. Weights and a report shipped, training data and training code did not.
Downloading is not serving
The raw MXFP4 weights are around 1.4 TB before KV cache and runtime overhead, so no single H100, H200 or B200 holds this. The practical floor discussed publicly is one 8x H200 node at MXFP4, or eight nodes of 8x H100 with cross-node tensor parallelism at higher precision. Rental reference: an 8x H200 node runs roughly $50 an hour on CoreWeave, about $36k a month if you leave it on. On Hacker News the buy-the-rack case penciled out too, a GB300 rack at around $6M with 20.7 TB of HBM serves the model inside 10 percent of its memory and lands under $0.60 per million output tokens at about half utilization, well under the $3 / $15 API pricing. That is a real argument. It is an enterprise argument.
Which is why I do not buy the underclass framing as stated. Kenneth Rogoff wrote in June that the AI boom risks leaving billions behind, and Rory Truex reports that most industry insiders he talks to expect AI to increase inequality by default while calling the permanent underclass phrase partly a meme. Capability access and compute access came apart. The binding constraint moved from weights to GPUs, power and bandwidth, all of which are capital-heavy and concentrated in few hands. A 1.5 TB file you cannot serve is closer to a library card than a factory.
What it definitely is, though, is a copy nobody can deprecate. That is not nothing. I keep local copies of open weights for exactly this reason: a model I have on disk cannot be rate-limited, price-hiked, silently swapped for a worse quantization, or geofenced away from Estonia because someone in Washington or Beijing changed their mind on a Tuesday. Community quants are already up under unsloth/Kimi-K3-GGUF, following the K2.6 pattern of dozens of variants, and that is historically how the big MoEs eventually reach smaller rigs. The download is optionality, bought at 7 MB/s over two and a half days.
The week the file was on trial
He was pulling the weights during the exact week the American government was debating whether to make that illegal. On the 22nd of July, 2026, OSTP director Michael Kratsios accused Moonshot of running an internal platform for large-scale distillation of Anthropic's Fable model and of obtaining export-restricted NVIDIA chips. No public evidence has been released for either, independent researchers quoted in the coverage say the timeline does not support the distillation claim, and until documents show up it stays an allegation. Treasury Secretary Scott Bessent raised sanctions and an Entity List designation, the Huawei-2019 playbook. Axios reported the administration weighing options that could effectively ban Kimi K3 and Qwen in the US. On the 24th, Hugging Face, Meta, Microsoft, Mistral, NVIDIA, IBM, Palantir and Perplexity signed an open letter against premature restrictions on open weights.
Meanwhile the most neutral document in the pile got the least attention. A joint UK AISI and US CAISI preliminary assessment, published through NIST, found K3 significantly below the most capable frontier cyber models, though ahead of GLM-5.2, reaching step 17 versus 11 on an exploit-development task. That is the safety evidence, from two government institutes, and it does not support the frontier-weapon-on-a-hard-drive framing that the ban talk depends on.
Tom's Hardware made the structural point plainly: once weights are downloaded, a ban is close to unenforceable. The screenshot is the demonstration. A 1.5 TB file that is already on thousands of disks, mirrored, torrented and quantized, does not go back in the box. Whatever gets banned would be the act of holding it.
A Pixel at Hartsfield-Jackson
Which brings me to the other bookmark. Samuel Tunick, an American citizen, landed at Hartsfield-Jackson on the 24th of January, 2025, returning from the Dominican Republic. CBP pulled him into secondary, a supervisory officer from a Tactical Terrorism Response Team demanded the passcode to his Google Pixel, and the phone came back factory fresh. In November 2025 he was indicted on one count of 18 U.S.C. 2232(a), destruction or removal of property to prevent seizure, maximum five years. He pleaded not guilty. His federal defender Matthew Dodge moved to suppress, Magistrate Judge Christopher C. Bly held the evidentiary hearing on the 20th of July, 2026, and a ruling is not expected before late October. The Guardian broke it, TechCrunch and others followed.
The tweet that put it in my feed got the shape right and several specifics wrong, and the specifics are the whole case. This is not the evidence-destruction statute, it is a property statute, and the fight is whether erasing an encryption key counts as destroying property when the physical object still works. It was not generic federal agents, it was CBP at a port of entry invoking the border-search exception, reportedly telling him no warrant was needed because he had not entered the country yet. Forced him to unlock is the defense's characterization, not a finding: the defense says agents threatened seizure, gave no Miranda warning and denied his requests for a lawyer four times. And per Medianama the defense has not conceded that he deliberately triggered the wipe at all, describing the screen going blank, flashing, and the phone appearing to restart.
GrapheneOS documents the feature openly. A duress PIN or password irreversibly wipes the device and any installed eSIMs, works anywhere credentials are requested including the lockscreen, and gives no confirmation prompt. It works by destroying encryption keys rather than overwriting storage, which is why it is near-instant. The project also pushed back on the coverage by pointing out that duress is one optional component and not the core of its model, alongside hardware-backed encryption, secure-element rate limiting, auto-reboot to a before-first-unlock state, and blocking USB while locked. The picture above is the defense argument in visual form. The Pixel exists, it boots, it works. What is gone is access to data that was already encrypted and already inaccessible to the officer standing there.
The venue is bad for him. Riley v. California in 2014 required a warrant for a phone search incident to arrest, but the Eleventh Circuit, which covers Atlanta, held in United States v. Touset in 2018 that no suspicion of any kind is required for a forensic device search at the border, the most government-friendly rule of any circuit. The Fourth and Ninth require reasonable suspicion, the First allows suspicionless basic searches. Any suppression theory has to get past Touset. And even a win on suppression may not end it, because the alleged crime is the wipe itself, not something found on the phone.
The scale context matters more than the individual charge. CBP searched 55,318 devices in FY2025, 13,590 of them belonging to US citizens, out of roughly 419 million travelers. In FY2015 the figure was 8,503. Roughly six times more in a decade. Court filings say agents circulated Tunick's name and photo internally citing suspected terrorism activities tied to alleged association with Defend the Atlanta Forest, and the defense argues the questioning was pretextual. Whether he is himself a defendant in the Cop City RICO prosecution is not established, outlets say only linked to, and I am not going to assert it. Catalan police in July 2025 and French police in November 2025 both publicly associated GrapheneOS with criminals, after which the project moved infrastructure to Canada and Germany. A researcher told TechSpot the case suggests the OS is being treated as criminal by default.
The same question from two directions
Set the two next to each other. In one, a man spends two and a half days pulling a Chinese lab's frontier weights onto a disk in his house while his own government argues about whether that file should be legal to hold, and the honest technical answer is that a ban would be close to unenforceable because copies do not un-copy. In the other, a man walks through an airport with a phone whose contents he alone can decrypt, and the government's response to losing that copy is a five-year felony under a statute written about property.
Both stories are about the state's relationship to bits held locally by an individual. In the AI case the fear is that people have too durable a copy of something valuable, and the proposed fix is licensing and Entity Lists. In the border case the fear is that people can render their copy unreadable, and the fix on offer is a criminal charge for the act of protection working as designed. Neither claim comes with much evidence attached. No public proof for the Moonshot distillation accusation, and a border charge whose factual premise the defense has not conceded, filed in the one circuit where the Fourth Amendment does the least work.
As such, I would rather have the copy. Not because a 1.5 TB checkpoint makes anyone rich, it does not, the compute wall is real and the license already carves out anyone who earns money from it. I want the copy because both of these fights end up somewhere in the register of who has permission to hold data, and the party writing that register is the one with the most to gain from the answer. Tunick's ruling lands after late October 2026, and I will be reading the docket rather than the press releases when it does.