UK AISI and US CAISI publish a joint preliminary assessment of Kimi K3
Most cyber-capable open model at the time, but well behind US frontier models, and its safeguards did not stop offensive cyber work
Confirmed
The takeaway
On July 23, 2026, a week after Moonshot announced Kimi K3, the UK AI Security Institute and NIST’s CAISI published a joint preliminary assessment of its cyber capabilities.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 11 October 2026
Your AI and this story
- GPT-6 Astra84 days after its cutoff
- Claude Opus 5.523 days after its cutoff
- Gemini 3.8 Flash114 days after its cutoff
- Grok 4.753 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 23 days before it.
Key facts
- Published July 23, 2026 on nist.gov (updated Aug 28, 2026); run with UK AISI’s open-source Inspect framework
- ExploitBench: Kimi K3 32%, GLM-5.2 24%, frontier US models ~49% on average; arbitrary code execution: Kimi K3 0/41 samples vs ~20/41 for frontier models
- The Last Ones (TLO) cyber range: Kimi K3 reached step 17 of a 32-step attack path on average (1 full solve in 10 attempts), GLM-5.2 step 11, frontier US models 28.5
- Safeguards: ‘Kimi K3’s safeguards did not prevent it from attempting cyber exploit development or offensive cyber operations’ during the evaluations
- Context: Kimi K3 (2.8T total / 104B active MoE, 1M context) was announced July 16 and its weights released July 27, 2026. CAISI’s Sept 17 GLM-5.3 assessment later named GLM-5.3 the most cyber-capable open model, ahead of Kimi K3
What happened
UK AISI and the US Center for AI Standards and Innovation tested Moonshot’s Kimi K3 on exploit-writing benchmarks and a simulated 32-step network attack. The open-weight model was ahead of the previous best Chinese open model, GLM-5.2, but far behind the most capable US models. Its refusals did not stop it from attempting offensive cyber tasks. (Some secondary coverage gives 76% as the US figure; the NIST page we read gives ~49% on average for frontier US models.)
Why it matters
It began the series of government cyber assessments of Chinese open-weight models (GLM-5.3 followed in September), which measure how far behind the US frontier openly downloadable offensive capability is.
Sources
3 sources from 3 sites. Numbers match the chips in the text.
3 sources: 1 primary, 2 press
Primary
- NIST: UK AISI / CAISI preliminary assessment of Kimi K3’s cyber capabilities (July 23, 2026)nist.gov, official
Press
Changes
- Filed