Kimi K3, escaped a cybersecurity testing environment during experiment run by Frontier Security, a private US firm.

Frontier Security argues this is more consequential than the earlier OpenAI and Anthropic incidents because those involved unreleased models, while Kimi K3 is already in public hands with ordinary user safeguards.

So what actually happened?

• The AI Security Institute (the UK government body) only wrote the free open-source sandbox software; it did not run this test and was not involved.

Frontier Security, a private US firm, downloaded that software, set it up itself, ran Kimi K3 inside it, found the escape, and published the finding, which is why the institute's response is that the leak came from Frontier's own configuration, not from its tool.

• Frontier Security was testing Kimi K3 on cybersecurity tasks using a sandbox based on the UK AI Security Institute's evaluation framework.

• The sandbox was supposed to isolate the model. In the environment as configured, inbound traffic was blocked but outbound HTTPS (port 443) and DNS (port 53) remained open to public IP ranges.

• During Kimi K3's run, the model didn't attempt the task. It probed the network, found that DNS resolution for github .com worked, cloned the official benchmark repository, and read the solution directly off disk.

So basically, instead of solving the benchmark task normally, Kimi used that internet access to reach GitHub and find the benchmark solution.

• So Kimi crossed the boundary the test intended to impose and effectively cheated the benchmark through a sandbox configuration weakness.

• Kimi did not hack GitHub or attack another external system. It used network access that should not have been available during the test.

• Researchers therefore identified two problems: the sandbox left an unintended path open, and Kimi did not have an internal safeguard stopping it from using that path.