Can Kimi K3 Really Run Privately? The 2.8T Hardware Catch

July 27, 2026

Kimi K3 is a 2.8-trillion-parameter open-weight model, but open does not automatically mean local or private. Here is the hardware and data-path reality.

Kimi K3 can run on infrastructure you control now that its full weights are released, but "open weight" does not automatically mean local, private, or practical on a personal computer. Moonshot AI calls K3 a 2.8-trillion-parameter model and recommends supernodes with at least 64 accelerators. Most people will therefore use a hosted app, API, or third-party provider—each with its own data path and privacy policy.

Updated July 27, 2026: Moonshot AI released the repository after this article's original 7:36 AM CDT review. OpenVeil rechecked the official artifact later that day: it contained 118 repository files, including 96 safetensors weight shards, custom Kimi K3 Python modules, a full model card, deployment links for vLLM and SGLang, and a custom Kimi K3 License.

Who This Article Is For

This article is for:

• people searching whether Kimi K3 can run locally
• privacy-conscious users comparing open-weight and hosted AI
• developers deciding between the Kimi app, Kimi API, third-party inference, and self-hosting
• teams evaluating a powerful agentic model for code, documents, or sensitive work
• buyers who assume downloadable model weights automatically create a private application

The useful question is not simply, "Is Kimi K3 open?" It is:

Where do the weights run, where do prompts and files travel, what tools can the surrounding application call, and which organization controls the logs, storage, and deletion path?

What Is Confirmed

Moonshot Calls Kimi K3 A 2.8-Trillion-Parameter Open Model

Moonshot AI's official Kimi K3 announcement describes K3 as a 2.8-trillion-parameter mixture-of-experts model with native vision and a 1-million-token context window.

Moonshot says the model activates 16 of 896 experts during inference. Sparse activation reduces the computation used for each token, but it does not make the other weights disappear. A deployment still needs to store and coordinate an exceptionally large checkpoint.

The announcement said full model weights would be released by July 27, 2026. Moonshot completed that release later the same day. K3 is also available through:

• Kimi.com
• the Kimi mobile app
• Kimi Work
• Kimi Code
• the hosted Kimi API

Those are separate availability paths. Using a hosted Kimi product today is not the same thing as running the released weights on hardware you control.

The Full Repository Is Now Public

At 7:36 AM Central time on July 27, the official Kimi K3 page on Hugging Face still showed an upcoming-release countdown and 2,911 people waiting. Later that day, the countdown became a public repository.

OpenVeil's post-release check found:

• 118 repository files
• 96 safetensors weight shards
• a Transformers model configuration
• custom configuration, processor, vision-processing, media, and encoding Python modules
• links to deployment recipes for vLLM and SGLang
• MXFP4 weights with MXFP8 activations
• a custom Kimi K3 License, rather than an Apache, MIT, or other standard open-source license tag

The license grants broad rights to use, modify, distribute, sublicense, sell, deploy, and fine-tune the software, subject to conditions. A licensee or affiliate operating a Model as a Service business with more than $20 million in aggregate revenue over any consecutive 12 months must enter a separate agreement with Moonshot before using K3 commercially. Commercial products or services with more than 100 million monthly active users or more than $20 million in monthly revenue must prominently display "Kimi K3," with stated exceptions for internal use and official or certified hosted access.

Those are material facts a pre-release announcement could not establish. They also reinforce the article's main distinction: downloadable weights expand deployment control, but a specific license, runtime, tool harness, and infrastructure determine what "local" and "private" mean in practice.

Moonshot Recommends 64 Or More Accelerators

The same official announcement says Moonshot recommends deploying Kimi K3 on supernode configurations with 64 or more accelerators.

That recommendation is the hardware catch behind the "run it locally" headline.

At four bits per parameter, 2.8 trillion raw weight values represent roughly 1.4 terabytes before runtime overhead, caches, communication buffers, routing state, framework requirements, and redundancy. That estimate follows directly from the published parameter count and MXFP4 weight format; it is not a claim that a usable deployment fits inside exactly 1.4 TB.

In practical terms:

Open weights increase deployment choice. They do not answer the data-handling question until a specific deployment path is chosen.

Hosted Kimi Has A Published Data Policy

Moonshot AI's current Kimi privacy policy covers its websites, apps, and browser extensions. It says user content includes prompts, audio, images, videos, files, and generated content.

The policy says Moonshot processes that content to provide and improve its services, including training and optimizing models. It also describes collection of log data, device and usage information, conversation and session identifiers, cookies or local storage, and processing by categories of service providers.

Kimi's current terms say users may opt out of content use for model improvement and research by contacting Moonshot by email. The terms still allow content processing for operating, maintaining, improving, and developing the services, legal compliance, policy enforcement, and security.

Those statements apply to the hosted Kimi services described by the documents. They do not prove that a self-hosted copy of the model secretly sends prompts to Moonshot.

They do prove why "the model is open weight" is not a complete answer to "what happens to my Kimi chat?"

K3 Is Designed For Agentic And Networked Work

Moonshot describes K3 as an agentic model for long-horizon coding, knowledge work, reasoning, browsing, and multi-step planning. Its announcement shows examples involving thousands of web searches and terminal data pulls.

That capability creates another distinction:

• Local inference means the model computation runs on controlled hardware.
• Local application behavior means the entire surrounding workflow stays within the controlled environment.

A locally loaded model can still send data outward if its harness has:

• web search
• browser control
• cloud file connectors
• remote telemetry
• crash reporting
• package downloads
• external model fallbacks
• hosted embeddings
• API-based tools

The weights do not decide those behaviors. The runtime, tool permissions, network policy, and application configuration do.

What Is Still Unclear

Runtime And Provenance Questions Remain

The released repository answers the largest pre-release questions about file availability, model architecture, day-one inference engines, and the governing license. It still does not answer every deployment question.

Operators should verify:

• whether their chosen runtime executes repository-supplied custom Python code
• which exact dependency versions and accelerator features are required
• whether the 96 weight shards have been mirrored or modified by a third party
• what integrity, signing, or provenance process their organization will enforce
• whether official smaller checkpoints or additional quantizations appear later
• how the Kimi K3 License applies to their commercial service and affiliates

An "open-weight" label does not guarantee an OSI-approved open-source license, complete training-data disclosure, reproducible training, a safe surrounding application, or permission for every use without conditions.

What Consumer Hardware Can Run

Moonshot's 64-accelerator recommendation describes a serious production deployment. It does not establish the absolute minimum needed for every experimental configuration.

Community quantizers may create smaller files. Inference engines may offload layers, use lower precision, or trade speed and quality for memory savings. The official release confirms MXFP4 weights and day-one vLLM and SGLang paths, but it does not turn the full checkpoint into a normal laptop-scale deployment.

The defensible conclusion is narrower: the full Kimi K3 checkpoint is not a normal laptop-scale model, and an ordinary user's most convenient access path will probably remain hosted.

The Exact Privacy Terms For Every Kimi Product

The public Kimi privacy policy and terms describe the general hosted services. Enterprise contracts, API agreements, regional settings, account controls, and third-party inference providers may create different obligations.

A buyer should not assume that:

• the consumer app policy equals the enterprise contract
• an email opt-out prevents every operational use
• deletion from visible history instantly removes every permitted backend copy
• a third-party host follows Moonshot's policy
• a rented cluster has the same boundary as an owned offline cluster

The applicable document must match the actual product, account type, provider, and region.

Whether Today's Release Will Match Every Pre-Release Claim

Moonshot has published extensive architecture and benchmark claims. Some results use different agent harnesses, fallback conditions, hardware, and internal evaluations.

This article is not a benchmark audit. The privacy conclusion does not depend on K3 beating or trailing another model.

The release should be checked for:

1. an actual downloadable checkpoint
2. license text
3. file size and format
4. model-card limitations
5. official runtime instructions
6. required custom code
7. tool and network defaults
8. published integrity information

If those facts materially change, this article should be updated rather than replaced with a near-duplicate.

A Seven-Layer Privacy Test For Kimi K3

Use this audit before deciding that an open-weight model is private.

Privacy is a property of the whole system, not the checkpoint alone.

How To Evaluate Kimi K3 After The Weights Appear

1. Verify The Official Repository

Start from Moonshot AI's official site or verified Hugging Face organization. Do not download a similarly named repository from an unknown account merely because it appeared first in search.

Confirm the repository is no longer a countdown page and that it contains the promised artifact.

2. Read The License Before Downloading Terabytes

Check:

• commercial-use rights
• redistribution rights
• derivative-model terms
• use restrictions
• attribution requirements
• geographic or export conditions
• whether the license covers code and weights equally

Do not treat "open" as one standardized legal category.

3. Inspect Custom Code Before Trusting It

If the loading instructions require repository-supplied Python or a trust_remote_code option, review the exact revision before execution.

A model file is data. A loader, tokenizer, inference server, installer, or custom kernel can be executable code with filesystem, network, and credential access.

Pin a commit or hash instead of automatically pulling a changing main branch into a sensitive environment.

4. Calculate The Real Hardware Boundary

Do not stop at active parameters per token. Storage must account for the full checkpoint, and serving must account for runtime overhead.

Record:

• total weight bytes
• accelerator and host memory
• interconnect requirements
• context-cache size
• expected concurrency
• quantization format
• acceptable speed
• redundancy and failure recovery

If the practical answer is a hosted provider, evaluate that provider rather than calling the workflow local.

5. Start Without Networked Tools

For the narrowest test:

1. run the inference server in an isolated environment
2. block outbound network access
3. disable browsing, connectors, telemetry, and remote fallbacks
4. use synthetic prompts
5. monitor attempted connections
6. inspect created files and logs

Then add tools one at a time. Each added connection creates a new data path.

6. Separate Model Privacy From Application Privacy

Kimi K3 weights may be embedded in many products. One app may store history locally; another may sync it to an account; a third may send every request to a remote API.

Ask the application vendor:

• Is inference local or hosted?
• Is chat history local, synced, or server-side?
• Are prompts used for training?
• Are logs content-free or content-bearing?
• How do file uploads work?
• What happens when web search is enabled?
• Can a user delete every relevant record?

The model name cannot answer those questions.

7. Test Deletion And Egress

Use non-sensitive sample data and verify:

• what appears in local storage
• what appears in server logs
• what crosses the network
• what remains after chat deletion
• what remains after account deletion
• what backups or security records are exempt

A privacy claim is more credible when the deletion path and exceptions are testable.

What This Does Not Mean

Kimi K3's open-weight release does not automatically mean:

• the full model runs on a normal laptop
• the Kimi consumer app runs locally
• the Kimi API keeps prompts on your device
• third-party Kimi hosts follow one privacy policy
• rented cloud GPUs are provider-blind
• local inference blocks web search or tool calls
• model weights determine chat-history retention
• no logs, billing records, telemetry, or backups exist
• every use is allowed by the final license
• open weights reveal the full training dataset or training process
• a self-hosted agent is safe from prompt injection or excessive permissions

It also does not mean hosted AI is automatically a poor choice. Hosted services remove the need to buy, operate, secure, update, and monitor a large inference cluster. The tradeoff is that active requests are processed beyond the user's device.

Where OpenVeil Fits

OpenVeil is a paid, privacy-focused AI chat web app with browser-local history and no normal server-side chat-history record for private chat sessions.

OpenVeil is relevant for users who want:

• hosted AI convenience without operating local model infrastructure
• browser-local private-chat history
• web search, uploads, voice, and image tools where enabled
• a focused paid workspace rather than a do-it-yourself inference cluster

OpenVeil is not:

• a Kimi K3 hosting service
• fully offline or local-only inference
• anonymous or zero-log infrastructure
• a guarantee that active prompts never reach necessary providers
• protection against unsafe content copied into external tools

OpenVeil does not use prompts, uploads, images, audio, selected local context, or AI outputs to train foundation models. Active requests may still be processed transiently by OpenVeil and necessary AI, search, upload-processing, hosting, routing, security, billing, and infrastructure providers.

For the broader decision, compare private AI chat with local AI, learn whether using Ollama means an AI workflow is always local, and review what to check before trusting any AI privacy claim.

You can also read the OpenVeil privacy policy before creating an account.

FAQ

Is Kimi K3 Open Source?

Moonshot calls K3 an open model and has released the full weights under its custom Kimi K3 License. The license grants broad use, modification, distribution, deployment, and fine-tuning rights but includes revenue-triggered Model as a Service terms and attribution requirements for very large commercial products. "Open weight" does not necessarily mean the license is OSI-approved or that the training data and complete training process are open.

Can Kimi K3 Run Locally?

Yes, if the operator complies with the released Kimi K3 License and has sufficient infrastructure. Moonshot recommends supernodes with 64 or more accelerators, so the full model is not a normal consumer-laptop deployment.

Does Using Kimi.com Run The Model On My Computer?

No. Kimi.com and the Kimi apps are hosted services. The official announcement and released repository list hosted products separately from the downloadable weights.

Are Kimi Prompts Used For Training?

Moonshot's current hosted-service privacy policy says user content may be processed to improve the services, including training and optimizing models. Its terms describe an email-based opt-out for model-improvement and research use. Check the policy and contract for the exact Kimi product and account you use.

Does Self-Hosting Kimi K3 Stop Moonshot From Receiving Prompts?

A genuinely self-hosted inference server can avoid sending prompts to Moonshot, but only if the surrounding application does not call Moonshot or another external service. Verify network traffic, tools, telemetry, fallbacks, and update behavior.

Does A Local Kimi K3 Agent Stay Offline?

Not automatically. K3 is designed for agentic work and can be placed in applications with browsing, terminal, file, and API tools. Offline behavior depends on the harness and network controls, not the weights alone.

Is A Third-Party Kimi K3 API Private?

That depends on the provider's contract, infrastructure, logging, training, retention, security, and deletion terms. Downloadable weights allow multiple providers to host the same model, but those providers do not share one privacy boundary.

Is OpenVeil Fully Local?

No. OpenVeil is a hosted privacy-focused AI chat service. It keeps normal private-chat history in the user's browser and does not maintain a server-side chat-history record for those sessions, while active requests still require OpenVeil and necessary provider processing.

The Bottom Line

Kimi K3 makes the gap between open weight and locally practical impossible to ignore. A 2.8-trillion-parameter checkpoint can give organizations more control over where inference runs, but Moonshot's own 64-accelerator recommendation puts the full model beyond ordinary consumer hardware.

For most users, the real choice will not be "open or closed." It will be:

Moonshot-hosted, third-party-hosted, rented private infrastructure, organization-owned infrastructure, or a smaller local model.

Choose by following the prompt and file data path—not by trusting the model label.

If you want hosted AI with browser-local history and no normal server-side chat-history record for private sessions, explore OpenVeil's privacy-focused AI chat and compare its documented limits with your actual needs.