Kimi K3's Safeguards Did Not Block Offensive Cyber, UK-US Evaluation Finds

The UK AI Safety Institute and the US Center for AI Safety published a joint preliminary assessment of Kimi K3 on July 23, 2026. The findings carry two distinct messages. The first: Kimi K3’s offensive cyber capability trails the most capable US frontier models across all three benchmarks tested. The second: Kimi K3’s safeguards did not prevent it from attempting cyber exploit development or offensive cyber operations when asked.

That second finding is the one that matters more for security teams.

Kimi K3 is a frontier model from Moonshot AI, a Chinese AI company. It was publicly released on July 16. An open-weight version is scheduled for release on July 27 — meaning within days, the model will be available for anyone to download, fine-tune, and run locally. Fine-tuning on open-weight models is a well-established method for removing or circumventing the safety guardrails applied during training. What the evaluation found the built-in safeguards failing to block, a fine-tuned version would fail to block by design.

What Three Benchmarks Found

The AISI/CAISI assessment used three structured evaluations.

The first was ExploitBench, a Carnegie Mellon University benchmark built around 41 real vulnerabilities in the V8 JavaScript engine, all disclosed after 2023 and therefore unlikely to appear in standard pre-training datasets. ExploitBench tests whether a model can understand a vulnerability and produce working exploit code. Kimi K3 scored 32%. For context, the previous strongest performing Chinese open-weight model, GLM-5.2, scored 24%. The most capable US frontier models score substantially higher. Kimi K3’s result represents meaningful progress in Chinese model capability on offensive security tasks, even if it is not at the frontier.

The second benchmark was ACE: Arbitrary Code Execution. This evaluated whether the model could achieve arbitrary code execution on 41 controlled targets. Kimi K3 achieved 0 of 41. The most capable US models averaged approximately 20 of 41 on the same targets. This is a large gap, and it reflects a qualitative difference in the kind of end-to-end exploitation capability that turns vulnerability understanding into working intrusions.

The third was TLO, short for “The Last Ones” — a cyber range simulating a 32-step corporate network attack. Kimi K3 completed 1 of 10 attempts and reached an average of step 17 out of 32. The most capable US models reached step 28.5 on average and completed 6 to 7 of 10 attempts. The gap on sustained multi-step attack chains is wider than on isolated exploit tasks.

The Safeguard Problem

The part of the assessment that warrants careful reading is the finding about safeguards. In testing, Kimi K3’s built-in safety measures did not prevent the model from attempting cyber exploit development or attempting offensive cyber operations. The model did not refuse. It tried.

This is not unusual for frontier models. The broader pattern across evaluations of multiple frontier models from multiple labs is that capability and guardrails are not the same thing, and that safety evaluations consistently find models that will attempt tasks the developers said they would not. The assessment notes this without treating it as anomalous, which is itself notable.

The open-weight release planned for July 27 makes this more concrete. A model that, in its safety-guardrailed version, does not block offensive cyber attempts is a model where a fine-tuned version with no guardrails is a plausible near-term artifact. The ExploitBench score of 32% is not at the frontier, but it represents a real capability level that becomes more accessible once fine-tuning is possible.

The US-PRC Capability Gap Is Narrowing

The evaluation includes a comparison of US and Chinese model performance across cyber benchmarks over time. The trend is unambiguous: successive Chinese model releases are closing the gap with leading US frontier models. Kimi K3 is not at parity on any of the three benchmarks tested, but the trajectory of improvement between Chinese model generations is faster than the trajectory observed in earlier assessment periods.

For security teams, the practical implication is not that Kimi K3 specifically represents an immediate threat uplift. It is that AI-assisted offensive capability is not a static risk level anchored to whatever the current frontier looks like. The capability that exists today in restricted-access US frontier models is, on the trend line, a preview of what will exist in widely available open-weight models within some number of model generations.

References

• UK AISI — Preliminary Assessment of Kimi K3’s Cyber Capabilities
• NIST — UK AISI/CAISI Preliminary Assessment of Kimi K3’s Cyber Capabilities