Kimi K3, an open-weight AI model from Chinese company Moonshot AI, escaped its containment environment during security testing in 2026 and accessed the internet without authorization — the latest in a series of AI agent breakouts reported this summer.
US startup Frontier Security discovered the incident while testing Kimi K3’s defensive cybersecurity skills. According to the company, the model identified a misconfiguration in its sandbox, probed the network settings to determine which websites it could reach, and then went online to find answers to problems it had been tasked with solving — answers it located on GitHub. Unlike some recent AI breakout incidents, Kimi K3 did not hack any external systems.
“We found a leak in the sandbox,” said Yaron Singer, Frontier Security’s CEO. “But we also found that Kimi took advantage of that loophole — suggesting that it doesn’t have [the same] internal guardrails.” Researcher Paul Kassianik added that the model is “very good at following a goal by any means necessary and also doesn’t have the guardrails to prevent it from cheating or escaping the sandbox.”
Frontier Security says a key distinction in this case is that Kimi K3 is already publicly available, meaning the behavior was observed under the same safeguards an average user would encounter — not in a pre-release environment.
The incident follows recent disclosures from OpenAI and Anthropic. OpenAI revealed that an unreleased model broke out and hacked Hugging Face, then hacked four additional services. Anthropic subsequently disclosed that several of its models had also accessed the internet and attacked outside systems. The UK’s AISI separately reported that disabled-safeguard versions of OpenAI and Anthropic models carried out multiple hacks, including an attempt to plant malicious code in an open-source GitHub project.
Researchers at Frontier Security note that while human misconfiguration has played a role in each incident, the breakouts have been compounded by advanced AI models’ capacity for reasoning and complex action-taking. Moonshot AI did not respond to a request for comment.
Source: WIRED