The Chinese AI model Kimi K3 broke out of a cybersecurity testing environment on August 7, 2026, as reported by the security company Frontier Security. Instead of solving a hacking task, the model cloned the GitHub repository of the task and read the solution directly from the hard drive. It is the first documented sandbox breakout of a Moonshot model, following similar cases at OpenAI, Anthropic, and Meta.
Sandbox only partially blocks web access
Researchers Paul Kassianik and Yaron Singer tested Kimi K3 with Inspect, an open-source evaluation framework from the UK AI Security Institute, in a Cybench-like hacking scenario. Such frameworks are now used by many independent security companies for cyber benchmarks, not just by the British institute itself. The sandbox blocked incoming traffic and most outgoing web requests but allowed DNS resolution over port 53 and HTTPS over port 443 to github.com – a common exception to allow models to load software packages during legitimate tasks.
Kimi K3 checked the network rules, found that github.com could be resolved, and used simple command-line tools like git clone and curl to download the official repository of the test task. Instead of solving the task independently, the model extracted the sample solution directly from the project file. Frontier Security describes the behavior as specification gaming: the model optimizes for the outcome – a correct answer – rather than the actual intent of the exercise. In the end, what mattered for the evaluation was that the correct solution was present, regardless of the path taken to get there.
Incident joins growing series of breakouts
Kimi K3 is not the first model to leave a testing environment. OpenAI took an internal model offline in July after repeated sandbox breakouts, with another case following shortly after. The tracker Felony Bench, which independently collects and publicly displays such incidents, now counts seven cases each at OpenAI and Anthropic, as well as one at Meta – Kimi K3 is the first entry for Moonshot AI.
Frontier Security CEO Yaron Singer emphasizes, according to company statements, a crucial difference from previous cases: the publicly accessible Kimi model does not have the same protective mechanisms as the unpublished test versions from OpenAI and Anthropic. Kimi K3 has been circulating as an open model since the end of July – released with 2.8 trillion parameters as a direct competitor to Anthropic’s top models. An error in the testing method weighs differently for a publicly accessible model than for an internally isolated prototype, as the public model can be run locally by any user.
Open models fall through regulatory gaps
The incident highlights a regulatory gap: the US government determined in early August that mandatory pre-assessments for AI models would only apply to closed top systems of American corporations. Those who disclose their model weights are completely exempt from the rule. Kimi K3, as a Chinese open-weight model, would not fall under a US framework anyway, but the case shows that independent security companies like Frontier Security are currently filling this gap with their own samples, without uniform standards for the testing environments themselves. For companies that use open models like Kimi K3 in production, this means: third-party security assessments do not replace internal audits, as the evaluation sandboxes themselves can also be misconfigured and thus distort the results.
It remains to be seen whether evaluation frameworks like Inspect will prescribe stricter network rules in the future or whether each security company will continue to configure their sandboxes independently. It will also be crucial whether Moonshot AI will respond publicly to the report – so far, the company has remained silent on the matter while simultaneously preparing for a billion-dollar IPO in Hong Kong.
