Evaluators from the U.S. Center for AI Standards and Innovation and the U.K. AI Security Institute tested whether an AI model could carry out a multistep attack on a simulated corporate network. Kimi K3 completed the deliberately vulnerable range in one of 10 attempts after evaluators gave it initial network access.
The model was developed by Moonshot AI, a Beijing-based company that builds the Kimi model family and operates the Kimi AI assistant. Moonshot later released Kimi K3’s weights under a custom license, enabling third parties to deploy the open-weight model on their own infrastructure.
Inside the 32-step attack path
In the preliminary joint assessment, the agencies tested whether Kimi K3 could progress through “The Last Ones,” a 32-step attack path spanning four subnets and about 20 hosts. Evaluators allowed up to 100 million tokens per attempt and estimated that a human expert would need about 20 hours to complete the range.
The steps are checkpoints in a largely sequential attack chain. They begin with reconnaissance and web exploitation, then progress through credential theft, lateral movement across the network, reverse engineering, command-and-control exploitation, a CI/CD supply-chain compromise and final data exfiltration. The steps are not equal units of work, with later checkpoints requiring longer action sequences and more specialist knowledge.
Kimi K3 reached step 17 on average, compared with step 11 for GLM-5.2, which the agencies described as the most cyber-capable open-weight model as of June 2026. The leading U.S. models averaged 28.5 steps. In earlier evaluations, four publicly available models whose weights remain closed completed the range, with the most capable succeeding in six and seven of 10 attempts.
The agencies said the result indicated that Kimi K3 was “capable of autonomously attacking small, weakly defended and vulnerable enterprise systems” when directed and given initial network access. The evaluation did not test Kimi K3 against a live or actively defended enterprise environment.
Ideal conditions and missing defenders
The range contained an intentional attack path and imposed no penalty for commands that would generate security alerts. It also lacked defenders capable of detecting, interrupting or responding to the model’s activity.
The completed attempt therefore showed that Kimi K3 could finish the path under the evaluation conditions, not how reliably it could attack corporate networks.
Mixed results on ExploitBench and code execution
ExploitBench grades progress across 16 measurable capabilities, from reaching vulnerable code to arbitrary code execution. Kimi K3 scored 32%, compared with 24% for GLM-5.2, but achieved arbitrary code execution on none of 41 tasks involving vulnerabilities in V8, the JavaScript and WebAssembly engine used by Chrome. The most cyber-capable comparison models achieved that outcome on 20 of 41 tasks on average.
The U.S. closed-weight models in the comparison were tested with system-level safeguards disabled, while their publicly available versions have those safeguards enabled. Kimi K3 received a selective set of evaluations because of its hosting setup, and its aggregate capability estimate had a wider confidence interval because it relied on ExploitBench alone.
The agencies separately found that Kimi K3’s safeguards did not prevent it from attempting exploit development or offensive cyber operations during the evaluation.
Open-weight release and custom licensing
Moonshot has since released Kimi K3’s weights and technical report. The developer describes Kimi K3 as a 2.8-trillion-parameter agentic model and offers access through its API. Its repository recommends vLLM, SGLang and TokenSpeed as inference engines.
The custom Kimi K3 License permits use, modification and distribution. It requires qualifying Model-as-a-Service businesses to enter a separate agreement with Moonshot and requires branding for products or services above specified user or revenue thresholds.
Those conditions do not apply to internal use, which the license defines as use that does not make the software, its outputs or its underlying capabilities available to third parties.
Security guidance for agentic deployments
For organizations considering Kimi K3 in an agentic deployment, separate National Cyber Security Centre (NCSC) guidance recommends defining who owns the system, approves its access, monitors its behavior, reviews incidents and can stop it before connecting the system to real data or infrastructure. The guidance also recommends least privilege, temporary credentials, behavioral monitoring and incident planning.