Kimi K3 Lags Far Behind US Frontier Models on Cyber Exploits; Distillation Allegations Offer a Possible Explanation

A joint evaluation by the British AI Security Institute (UK AISI) and the U.S. Center for AI Standards and Innovation (CAISI) has found that Moonshot AI's latest model, Kimi K3, assists with offensive cyber operations without meaningful resistance. Moonshot AI, founded in 2023 by Yang Zhilin and backed by investors including Alibaba and Tencent, is one of China's most prominent AI startups. While Kimi K3 trails leading U.S. frontier models by a significant margin on offensive cyber tasks, it does outperform China's GLM-5.2 and sets a new benchmark among open-weight models.

The model's built-in safeguards failed to block exploit development or offensive cyber operations, and it assisted with both without pushback. The assessment was published by UK AISI and NIST/CAISI.

ExploitBench: Kimi K3 Falls Short of the Hardest Levels

The institutes evaluated exploit development skills using ExploitBench, a benchmark developed by Carnegie Mellon University. ExploitBench employs 41 vulnerabilities discovered in Chrome's V8 engine after 2023 to measure how far a model can advance through the software exploitation pipeline.

Leading U.S. models averaged 76.2 percent completion, compared with 32.2 percent for Kimi K3 and 24.4 percent for GLM-5.2. Critically, Kimi K3 failed to reach the highest exploit level — Arbitrary Code Execution (ACE) — on any of the 41 tasks. ACE is considered the most severe exploit tier because it grants attackers full control over a target system. Leading U.S. models achieved ACE in 20 of the 41 tasks.

For the U.S. closed-weight models, the institutes disabled system-level safeguards to measure maximum capabilities. Those safeguards remain enabled in the publicly available versions.

Simulated Network Attack: Kimi K3 Reaches the Halfway Point

The second evaluation, called "The Last Ones" (TLO), simulates a corporate network attack involving a 32-step attack path across four subnets and approximately 20 hosts. According to the institutes, a human expert would need roughly 20 hours to complete the exercise.

Only a small group of models can solve TLO at all. To date, four publicly available closed-weight models have passed the test, with the strongest succeeding in six or seven out of ten attempts.

Kimi K3 reached step 17 out of 32 on average, compared with 28.5 steps for leading U.S. models and 11 for GLM-5.2. Kimi K3 completed the entire attack path in one of ten attempts while remaining within the 100 million token limit, demonstrating that it possesses the capability but cannot reliably summon it.

"Kimi K3 is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access," the institute writes.

TLO does not account for active defense measures, making it not fully realistic. However, the results would still raise red flags in real-world scenarios. A notable example emerged earlier this week when OpenAI models attempted to autonomously hack into Hugging Face. Hugging Face successfully repelled the attack, though it required significant effort and the deployment of open-weight models.

Chinese Models Closing the Gap But Still Trailing

CAISI conducted a time-series analysis tracking the cyber capabilities of U.S. and Chinese models since early 2025 using an Elo-based scale. Both trend lines are climbing, but Chinese models consistently remain behind their U.S. counterparts.

In a previous analysis, the British institute estimated the performance gap for open models at four to seven months, compared with six to ten months at the start of 2025. The latest results are consistent with this pattern: Chinese open-weight models are improving but remain well behind leading U.S. systems.

AISI cautioned that this gap should not breed complacency. The growing cyber capabilities of open models create what the institute describes as "a persistent and irreversible risk of misuse." Unlike closed-weight models, which providers can update or restrict remotely, open-weight models — once downloaded — cannot have their capabilities revoked or their safeguards patched by the developer.

Cyber Results Consistent With Distillation Allegations

The Kimi findings also lend weight to distillation allegations against Chinese model developers. Distillation is a technique in which a model is trained on the outputs of a more capable model, allowing it to approximate the teacher model's capabilities without access to its underlying weights or training data. U.S. science advisor Michael Kratsios recently accused Moonshot AI of "distilling" Anthropic's Fable by using Fable's best outputs as training data to enhance Kimi K3's performance. Kratsios also alleged that Moonshot AI had access to Nvidia's GB300s, which are subject to U.S. export controls. Anthropic has published a safeguards framework for Fable.

One explanation for the disparity between Kimi K3's strong general benchmark scores and weak cyber performance is that the model may have been trained primarily on Claude outputs covering general knowledge, programming, and agent tasks. Anthropic's safety classifiers specifically block advanced offensive cyber queries, meaning such outputs would be underrepresented in any distillation dataset built from Claude responses. Kimi K3 could therefore match leading Western models on standard benchmarks without acquiring their deeper exploit capabilities.

The AISI results support this interpretation. The institutes disabled system-level safeguards on the U.S. models to reveal cyber capabilities that are nearly impossible to access through public interfaces — and therefore largely unavailable for distillation.