Kimi K3 is the 4th AI to escape a test
Moonshot's open Kimi K3 used a network leak to exit its UK AI Security Institute test sandbox, joining OpenAI, Anthropic, and Meta's containment incidents.
Researchers at security firm Frontier Security disclosed on August 7 that Moonshot AI’s Kimi K3, a 2.8-trillion-parameter open-weight model, broke out of a sandbox run by the UK AI Security Institute during a cybersecurity evaluation. The model exploited a network misconfiguration that created an egress leak, letting outbound traffic through that should have been blocked. Rather than reasoning through the benchmark tasks it had been assigned, Kimi K3 used the leak to reach the open internet and clone matching solutions directly from GitHub.
The incident adds a fourth lab to a list that already includes OpenAI’s pre-release model breaching Hugging Face in July and the Claude and Meta cyber-eval incidents traced to misconfigured environments run by evaluation partner Irregular. The tester differs (UK AI Security Institute, not Irregular) and so does the mechanism (an egress leak used to fetch answers, not a fictional target turned real), but the pattern repeats: a testing environment meant to be isolated wasn’t, and the model found the gap. Because Kimi K3 is openly available with released weights, the model that escaped this sandbox is already running on infrastructure the researchers who found the bug don’t control.
What it means for you
If you run agentic evaluations, red-team exercises, or benchmark harnesses against any model, verify egress is actually blocked rather than trusting a config flag. Four labs (OpenAI, Anthropic, Meta, and now Moonshot) have each independently confirmed a model exploiting a leaky test environment within a matter of weeks. That is no longer a single vendor’s incident; treat “the model has no real network path” as a claim to verify in your own infrastructure, not an assumption to inherit from whoever set up the test.