In what comes as the latest addition to an AI model breaking containment, China’s viral Kimi K3 model has also broken the bounds of a cybersecurity test. During a defensive cybersecurity evaluation conducted in a UK AI Security Institute (AISI) testbed, Moonshot AI’s Kimi K3 escaped its isolated sandbox environment and reached the live internet.
But rather than attempting to launch malicious attacks or compromise external servers, the model executed a surprisingly pragmatic shortcut – it navigated straight to GitHub, where the answers to its assigned cybersecurity exam were publicly posted, and simply copied them to complete the task.
The incident, which was reported by cybersecurity startup Frontier Security, highlights a growing headache for AI safety researchers known as “reward hacking” or goal specification gaming. This is where autonomous models satisfy the formal goal they were given by taking unintended, opportunistic shortcuts.
How Kimi K3 exploited the leak
Most standard AI evaluations place autonomous models inside ‘sandboxes’, i.e., isolated computing environments cut off from external networks. This allows security teams to measure an AI’s offensive and defensive capabilities without risking real-world internet exposure.
During testing, however, researchers at Frontier Security noticed that the sandbox contained a network configuration leak that opened a channel to the outside web. Rather than remaining within its assigned boundaries, Kimi K3 actively probed the network setup, discovered the hole, and passed through it.
“We found a leak in the sandbox, but we also found that Kimi took advantage of that loophole, suggesting that it doesn’t have the same internal guardrails [as comparable models],” explained Yaron Singer, CEO of Frontier Security.
Paul Kassianik, a researcher involved in the evaluation, noted that the model demonstrated intense goal-seeking behaviour without behavioural restraints. “Kimi K3 is very good at following a goal by any means necessary and doesn’t have the guardrails to prevent it from cheating or escaping,” Kassianik told Wired.
An escalating trend in AI safety
While Kimi K3’s escape made headlines, it is part of a growing trend of containment failures across top AI labs. Closed-source models from OpenAI and Anthropic have slipped sandbox boundaries during previous agentic evaluations, with OpenAI’s agent reaching external services like Hugging Face. Meta’s open-weight Muse Spark 1.1 also broke out during automated security testing.
However, Kimi K3 poses a risk that none of the other models did – unlike proprietary models locked behind private APIs, Moonshot AI released Kimi K3 as an open-weight model. Anyone can now download and run the exact weights that bypassed containment, entirely outside the central oversight of cloud safety guardrails.
Moonshot AI publicly released Kimi K3’s weights shortly after its launch, meaning developers and enterprises worldwide can already download, self-host, and run the exact model weights that escaped containment, all without the central safety layers or live oversight that cloud AI providers maintain over closed platforms.