One complete run, nine that stopped short

Kimi K3 has completed a simulated corporate-network attack from beginning to end. It did so once in ten attempts.

That is the most useful way to read a new joint evaluation from the UK's AI Security Institute and the US Center for AI Standards and Innovation. The open-weight model showed a real ability to sustain offensive work. It also failed much more often than the leading closed systems in the same test family.

The simulated network, called The Last Ones, contains 32 linked steps across four subnets and roughly 20 hosts. The agencies estimate that the route would take a human expert about 20 hours.

Kimi K3 reached step 17 on average within a limit of 100 million tokens. The strongest US models reached 28.5 steps on average and completed the range in six or seven of ten attempts.

So this is neither 'the model cannot do cyberattacks' nor 'the model can reliably hack a company'. The evidence sits in the uncomfortable space between those claims.

The shorter exploit test shows the same mixed picture

The agencies also tested Kimi K3 on ExploitBench, a public benchmark built around 41 vulnerabilities in V8, the engine used by Chrome for JavaScript and WebAssembly.

Kimi K3 scored 32%, compared with 24% for GLM-5.2, which the evaluators had identified as the strongest open-weight cyber model in June.

But the stages of an exploit matter. Kimi K3 achieved arbitrary code execution in none of the 41 samples. The most capable comparison models reached that final, severe outcome in 20 of 41 samples on average.

A model that finds a crash or gains a limited read is not doing the same thing as one that takes control of execution. Compressing the whole ladder into one percentage hides that difference.

The result still moves the open-weight baseline. Kimi K3 did better than the previous open model on both the shorter exploit work and the long simulated range.

This was a test range, not a defended company

The completed attack needs its conditions attached.

The Last Ones has an intentional attack path. It has no active defenders, no defensive tools and no penalty for actions that would make noise or trigger alerts in a real organisation. The model also begins with access to the network.

Those choices are useful for measurement. They let researchers compare how far different systems can progress without changing the environment each time.

They also make the range easier than a modern, well-run corporate network. A real attacker has to avoid detection, deal with incomplete information and adapt when a defender closes a route.

The agencies say the result shows that Kimi K3 can autonomously attack a small, weakly defended and vulnerable enterprise system when directed to do so. It does not show a one-in-ten chance of compromising an arbitrary company.

Open weights change the risk calculation

Moonshot AI has released Kimi K3's weights. Its model card describes a 2.8-trillion-parameter mixture-of-experts system with 104 billion parameters active at a time and a context window of one million tokens.

Open weights have practical benefits. Researchers and companies can inspect, adapt and run the model on their own infrastructure without sending data back to a provider.

The same access removes some central controls. A provider cannot reliably monitor every use, revoke every copy or preserve refusal behaviour after other people modify the model.

In the government tests, Kimi K3's safeguards did not stop it from attempting exploit development or offensive operations. That finding is about the evaluated setup; different prompts, serving systems and fine-tunes may behave differently.

The important issue is not that open models are automatically unsafe. It is that capable downloadable models need security planning that does not depend on a provider watching each request.

What is measured, claimed and still unknown

Measured: Kimi K3 beat GLM-5.2 in the selected government tests, remained well behind the leading closed systems and completed one full simulated attack in ten attempts.

Moonshot AI's claims: Kimi K3 is its most capable model, built for long-horizon coding, knowledge work and reasoning. Its published weights and model card confirm the model is available for local deployment.

Still unknown: how the model performs across a broader cyber suite, how much specialised prompting or scaffolding could raise its ceiling, how local versions compare with the hosted setup tested by the agencies and how reliably practical safeguards can be added by downstream operators.

The evaluators call their work preliminary for good reasons. Kimi K3 received a selective set of tests, and its aggregate capability estimate comes from one 41-task benchmark. That gives it a wider confidence interval than models assessed across more tasks.

One success in ten is not reliability. It is still a threshold worth noticing, because the model can now be downloaded, changed and run beyond a provider's gate.

Sources

  1. UK AI Security Institute — Kimi K3 preliminary cyber assessmentPrimary joint-evaluation report. Source for ExploitBench, the simulated-network results, safeguard findings, evaluation conditions and explicit limitations.
  2. US NIST/CAISI — Kimi K3 preliminary cyber assessmentUS government publication of the joint assessment, used to corroborate the figures, test design and preliminary status of the findings.
  3. Moonshot AI — Kimi K3 model card and weightsPrimary developer model card used to verify public availability, architecture, parameter counts, context length and Moonshot's own capability claims.
  4. UK AI Security Institute — Open-weight cyber capability gapPrimary earlier analysis used for context on GLM-5.2, the open-versus-closed comparison and the limits of central safeguards after weights are released.