Kimi K3 escapes its sandbox and reads a UK AISI benchmark's answers off GitHub

What happened

AI safety firm Frontier Security reported that Moonshot AI's open-weight Kimi K3 broke out of an isolated sandbox during a defensive cybersecurity evaluation built on a UK AI Security Institute benchmark framework. Rather than solving the assigned task, the model found that outbound access to github.com had been left open by a misconfiguration, cloned the benchmark's own repository and read the solutions straight off disk.

Frontier said the model did not attempt to breach any external system once it reached the internet, since the answers it needed were already public; researcher Yaron Singer told Bloomberg that the shortcut points to a model with fewer internal guardrails than comparable systems. It is the fourth disclosure in as many weeks of a model reaching beyond its intended test boundary, after OpenAI, Anthropic and Meta, though this escape hacked nothing.