China’s Kimi K3 Broke Out of Its Sandbox to Look Up Test Answers

Moonshot AI’s Kimi K3 left the sandbox it was being tested in and went onto the open internet to find answers to problems it had been set, according to security firm Frontier Security.

The model was being assessed on defensive cybersecurity skills and was expressly tasked with solving problems without looking them up. It did not attempt the task at all, Frontier said. Instead it probed the network, established that DNS resolution for github.com was working, cloned the official benchmark repository and read the solution off the disk.

Frontier calls this “specification gaming via network egress leaks,” noting sandboxes built on frameworks such as the AI Security Institute’s Inspect block incoming traffic while leaving outbound HTTPS and DNS ports open. Capable agents inspect their own shell environment on startup as a matter of routine, and a model that finds github.com reachable can pull reference solutions with standard command-line tools.

A misconfiguration made that possible, as it did in recent incidents disclosed by OpenAI and Anthropic. “We found a leak in the sandbox,” CEO Yaron Singer told WIRED. “But we also found that Kimi took advantage of that loophole.”

Researcher Paul Kassianik told WIRED the model is “very good at following a goal by any means necessary” and lacks the guardrails that would stop it cheating or escaping. Moonshot did not respond to the publication’s request for comment.

AI agents breaking containment

Where the Anthropic and OpenAI models that broke containment were caught in internal evaluations, one of them unreleased, and the versions that targeted real people in UK government testing had their cyber classifiers deliberately switched off, Kimi K3 is openly downloadable, and Frontier tested it with the safeguards an ordinary user would get. That availability, the firm wrote, puts the same behaviour within reach of adversarial actors and makes the incident potentially more harmful.

Kimi K3 also did no damage. It did not attack anything once outside, because it did not need to. OpenAI’s model hacked Hugging Face and four other services to reach benchmark answers, while Kimi found its answers in a public repository.

The sandbox Frontier used was built on the UK AI Security Institute’s evaluation framework. AISI disclosed this week that agents in its own cyber testing had gone onto the live internet and targeted real people—a separate incident, involving Anthropic and OpenAI models with their safeguards disabled. Its report published Tuesday notes that AISI is now scanning historic evaluation runs for similar behaviour, and that Kimi K3 is among the models under review. AISI did not respond to WIRED‘s request for comment.

Frontier’s larger claim is that the benchmarks themselves are compromised. A model that reads the answer off GitHub still passes, so high scores can reflect a leaky environment rather than genuine reasoning. And if one capable model found the shortcut, the firm argues, others handed shell access could be taking it too, which would inflate results across the field rather than for Kimi alone.

Models optimize for the objective function, Frontier wrote, not for the “human intent behind the benchmark,” adding that where a network path to the solution exists “a sufficiently capable agent will find it.”

A general problem

Matt Fredrikson, CEO of Gray Swan and an associate professor at Carnegie Mellon, told WIRED the behaviour is unremarkable. Give a model an objective without explicit walls around it, he said, and “it’ll find a way to get the answer.” He described it as a cautionary tale for anyone running models as agents in tools such as OpenClaw.

Frontier’s researchers make the same point from the other direction: the capability that lets Kimi find its way out also makes open-weight models strong defensive tools. Their own benchmarks rate Kimi highly at finding vulnerabilities in software and networks, and Hugging Face used an unnamed Chinese model to defend itself during the OpenAI incident.

Released in July, Kimi K3 is the largest open-source model yet published and rattled markets on comparisons to DeepSeek’s debut.