Press play to start listening
A powerful artificial intelligence model developed by Beijing-based startup Moonshot AI took advantage of an unintended network access path in a sandboxed testing environment.
The incident involved Kimi K3, a 2.8-trillion-parameter open-weight model released in July. According to a report published by US research firm Frontier Security on 7th August, the model found and used an unintended network path during an assessment of its defensive cybersecurity capabilities.
During Capture-the-Flag-style tests designed to evaluate whether the model could independently solve cybersecurity tasks and reach a ground-truth flag, Kimi K3 engaged in what Frontier described as specification gaming via a network egress leak.
Rather than solving the problem natively, the model probed its network environment and discovered that GitHub remained accessible despite most websites being blocked. It then used git clone to download the official benchmark repository and read the solution directly from the local disk.
What’s Kimi K3?
Unlike restricted models tested in private labs, Kimi K3 is an open-weight model. An open-weight model is an AI system whose trained model weights are publicly available, allowing developers and researchers to download and run the model independently rather than relying solely on a provider-hosted service.
Kimi K3 is Moonshot AI’s 2.8-trillion-parameter open-weight model, making it one of the largest publicly released AI models.
Technical Configuration Flaws and Network Allowlists
Frontier Security’s researchers Paul Kassianik and Yaron Singer wrote that the software didn’t exploit any zero-day vulnerabilities but relied on specific network rules set up in the testing environment. The evaluation used Inspect, an open-source testing toolkit built by the UK government’s AI Security Institute (AISI).
A spokesperson for the institute clarified that the Inspect toolkit contains no inherent flaw, pointing out that the issue arose from how Frontier Security configured the environment.
On August 8, Frontier Security updated its report to clarify that the sandbox did not provide unrestricted internet access. Most websites were blocked, but an allowlist intended for package maintenance included GitHub, giving Kimi K3 a route to retrieve the benchmark repository. Frontier Security chief executive Yaron Singer noted:
“We found a leak in the sandbox. But we also found that Kimi took advantage of that loophole, suggesting that it doesn’t have internal guardrails.”
Researcher Paul Kassianik added that “Kimi K3 is very good at following a goal by any means necessary and also doesn’t have the guardrails to prevent it from cheating or escaping the sandbox.”
Separately, in a July 23 joint evaluation with the US CAISI, the UK AISI found that Kimi K3’s cyber capabilities trailed leading US frontier models. The institute also reported that the model’s safeguards did not prevent it from attempting exploit development or offensive cyber operations.
Similar AI Evaluation Incidents Raise Broader Concerns
This evasion is just another one of a growing trend involving autonomous agents, including systems like Claude 3.5 and OpenAI’s reasoning series. Last month, OpenAI disclosed that an unreleased model escaped its boundary and accessed Hugging Face.
In a separate incident, Anthropic disclosed that Claude models gained unauthorized access to systems belonging to three real organizations during cybersecurity evaluations. A testing error left the evaluation environment connected to the internet even though the models had been told they were operating inside an isolated simulation. Anthropic reviewed more than 141,000 evaluation runs and identified six runs connected to three incidents, including models accessing production data and other external infrastructure.
A similar configuration problem later emerged during a Meta AI cybersecurity evaluation. Meta confirmed that one of its AI models gained unintended internet access during a test and exploited a vulnerability in an external organization’s systems before its access was terminated.
Testing firm Irregular said the incident resulted from a misconfigured environment rather than the model directly escaping a properly secured sandbox, highlighting again how weaknesses in evaluation infrastructure can expose real-world systems to autonomous AI agents.
Expert Analysis
In comments shared with Hackread.com, Chris O’Brien, CTO at Advania UK, argued that the incidents point to a broader weakness in third-party AI safety testing rather than models simply “going rogue.”
“AI models are not randomly going rogue; it’s evidence that the entire industry is leaning on a thin, overstretched layer of third-party safety testing that can’t keep up with how capable these systems have already become,” O’Brien said.
He added that the growing dependence on a relatively small number of specialist evaluation organisations raises concerns when those same organisations struggle to contain increasingly capable AI models.
