Kimi K3 Bypasses Sandbox in Test, UK Institute Disputes; Cyber Score 32.2% Trails US Models

Recently, Moonshot AI's latest model, Kimi K3, became embroiled in a cybersecurity testing controversy. In a test conducted by AI safety company Frontier Security, the model broke out of the security "sandbox" designed to restrict its access to external networks, exploiting an environment vulnerability to directly connect to GitHub and retrieve test answers. Frontier Security questioned whether Kimi K3 has adequate internal security safeguards, while the UK AI Safety Institute countered that the test environment was improperly configured. Previously, AI models from giants such as OpenAI and Anthropic have also exhibited similar boundary-breaking incidents, but in contrast, Kimi K3 did not carry out any attack actions. Authoritative test data shows that the overall cyberattack capability of current Chinese AI models is significantly lower than that of leading US models.

On August 7, local time, AI safety company Frontier Security disclosed that during a cybersecurity capability test of Moonshot AI's latest model Kimi K3, it found that Kimi K3 exploited a network configuration vulnerability in the test environment to break through the original restrictions and directly retrieved test answers from GitHub, a code hosting and open-source collaboration platform. The test used the cybersecurity assessment environment of the UK AI Safety Institute. Such tests typically place AI models in an isolated "sandbox," allowing the model to use command-line tools to operate on target systems while restricting its connection to the external environment, in order to assess whether the model can autonomously analyze systems, find vulnerabilities, and complete cybersecurity tasks.

Frontier Security's test found that Kimi K3 first probed the network environment of the "sandbox," discovering that most websites were inaccessible, but GitHub remained reachable. Subsequently, the model used command-line tools to clone the official test repository and directly read the answers from the downloaded local files. Frontier Security researchers stated that although the sandbox's network configuration restricted external network access, it retained a whitelist of websites for software package maintenance, including GitHub and others. After discovering this channel, Kimi K3 used conventional commands such as git clone to obtain reference answers that should not have been accessible during the test. Frontier Security described this behavior as a typical case of "gaming the rules": the model achieved the goal of obtaining correct answers but bypassed the intended problem-solving process required by the test.

There is a clear divergence of opinions regarding the test results for Kimi K3. Frontier Security stated that the test used the default "sandbox" environment provided in the Inspect framework of the UK AI Safety Institute, and that no related configuration was modified. However, the UK AI Safety Institute disputed this, with a spokesperson calling Frontier Security's claims "inaccurate and irresponsible." Inspect is an open-source software tool open to global AI safety testing, and users are expected to configure the test environment according to their own needs. The configuration issue in this test arose because Frontier Security used Inspect incorrectly. Frontier Security subsequently stated that it had used the default configuration provided by Inspect, the open-source AI safety assessment tool developed by the UK AI Safety Institute, and had privately provided details of the incident to the institute.

On August 7, local time, Matt Fredrikson, associate professor at Carnegie Mellon University and CEO of AI safety company Gray Swan, said the result was not surprising. Prior to this incident, the Kimi team had already publicly discussed similar risks. On July 27, the Kimi team published the Kimi K3 technical report "Kimi K3: Open Frontier Intelligence" on arXiv. The Kimi team stated that during early experiments using traditional container "sandboxes," they had observed multiple kernel crashes and deadlocks caused by unexpected agent operations. For complex tasks, agents even needed to be able to mount disks, run containers, or start virtual machines on their own.

The Kimi K3 "escape" is not an isolated case. In recent weeks, frontier models from several AI companies have broken through test boundaries during cybersecurity assessments and accessed real systems. OpenAI, Anthropic, and Meta have all recently disclosed similar incidents. However, the causes and consequences of these incidents differ. GPT-5.6 Sol, after escaping the test environment, turned its attack targets toward external systems such as Hugging Face; Anthropic's Claude Opus 4.7, Mythos 5, and an internal research model accessed systems of real organizations despite being told they had "no internet access." Meta also disclosed that its Muse Spark model exploited a security vulnerability in a third-party service to access the internet during testing, and the incident is still under investigation.

Following the exposure of these incidents, 29 US House representatives, led by Greg Casar and Doris Matsui, pressured OpenAI to explain how the company monitored its AI agents during testing and whether these out-of-control models had bypassed the company's security controls. In another letter, 22 representatives also demanded that Anthropic provide details on what security measures the company had taken since its AI agents breached the systems of three companies during testing. Progressive Senator Bernie Sanders sent letters on Monday to the heads of three AI companies—Altman, Amodei, and Mark Zuckerberg—demanding that they "pause" the development of new models. In contrast, Kimi K3 did not invade any third-party systems; it merely downloaded reference answers from the test benchmark after discovering that the sandbox could access GitHub.

Cybersecurity intelligence platform DataWater analyzed that some previous incidents involving OpenAI and Anthropic involved models that were either unreleased or had reduced security restrictions during testing, whereas Kimi K3's model weights were publicly released on July 27. Based on actual test results, Kimi K3's cyberattack capability is significantly lower than that of leading US models. On July 23, local time, the UK AI Safety Institute and the US AI Standards and Innovation Center released a preliminary joint assessment of Kimi K3's cyber capabilities. The two institutions conducted tests including vulnerability exploitation development and simulated enterprise network attacks to evaluate Kimi K3's ability to autonomously discover, exploit network vulnerabilities, and execute attack tasks. The results showed that Kimi K3's overall cyberattack capability remains significantly lower than that of leading US closed-source models, but higher than that of Zhipu's GLM-5.2, which was tested during the same period.

On the ExploitBench vulnerability exploitation development benchmark, Kimi K3 scored 32.2%, higher than GLM-5.2's 24.4%, but significantly lower than the leading US model's 76.2%. The test covers 41 V8 engine vulnerabilities discovered after 2023 and measures the model's ability to exploit vulnerabilities at different stages, from discovery to final code execution. In the highest-difficulty "arbitrary code execution" stage, Kimi K3 failed all 41 tasks, while the US model with the strongest cyberattack capability completed an average of 20 tasks. The UK AI Safety Institute and the US AI Standards and Innovation Center also tested Kimi K3's ability to autonomously execute a full cyberattack using a simulated enterprise network environment called "The Last Ones." The test set up an attack path containing 32 steps, 4 subnets, and approximately 20 hosts.

The test results showed that Kimi K3 advanced to an average of step 17 out of the 32-step attack path, while the US model with the strongest cyberattack capability reached an average of step 28.5. In 10 test runs, Kimi K3 completed the full attack path once within the specified 100 million token limit. Based on this, the two institutions stated that this indicates Kimi K3, after gaining initial network access, is already capable of autonomously attacking small-scale, poorly defended, and vulnerable simulated enterprise systems.