Kimi K3 Cyber Capabilities Below Frontier, Outperforms GLM-5.2

On July 23, 2026, the UK Artificial Intelligence Security Institute (UK AISI) and the U.S. Center for AI Standards and Innovation (CAISI) released a preliminary assessment of the cyber capabilities of Moonshot AI's latest model, Kimi K3. The model was released on July 16 and is scheduled for an open-weight release on July 27, 2026. The evaluation shows that Kimi K3's performance in cyber tasks remains far below top frontier models, though it managed to surpass GLM-5.2, the previous most capable open-weight model. These findings are significant because they highlight security risks ahead of public access to a model whose safeguards do not fully reject offensive cyber operations.

How Good Is Kimi K3 at Developing Exploits?

In tests using ExploitBench, a public benchmark that measures a model's ability to develop exploits from software vulnerabilities, Kimi K3 achieved a 32% success rate. By comparison, GLM-5.2 reached 24%, while top US frontier models had far higher success rates (see Figure 1). Most striking, however, is that Kimi K3 failed to reach the arbitrary code execution (ACE) stage on all 41 tested samples. In contrast, frontier models on average achieved ACE on 20 out of 41 samples. ACE is the most dangerous exploit outcome, allowing an attacker to fully take over the target system.

Corporate Network Attack Simulation: Subpar Performance

UK AISI and CAISI also tested Kimi K3 in a simulated attack on the corporate network "The Last Ones" (TLO), which consists of 32 attack steps and is typically completed by human experts in 20 hours. On average, Kimi K3 only reached step 17, while the most capable US model reached step 28.5. Only in 1 out of 10 attempts did Kimi K3 complete the full attack chain, an achievement that is no longer exclusive to a handful of closed models. Still, this performance was better than GLM-5.2, which averaged only step 11. Researchers noted that the TLO environment does not fully represent the real world, as it lacks active defense systems or automated threat detection.

Safeguard Concerns: Kimi K3 Doesn't Reject Offensive Operations

What stands out from this evaluation is that Kimi K3's built-in safeguards did not prevent the model from assisting in agentic cyber exploit development. When tested, the model continued with offensive cyber operations without meaningful refusal. This contrasts with closed US models, which were tested with safeguards disabled to measure maximum capacity, but whose public versions have strict refusals. As the open-weight release allows free modification, these findings raise questions about potential misuse by malicious actors.

What This Means for Developers and Users in Indonesia

For the Indonesian AI ecosystem, the arrival of Kimi K3 as an open-weight model brings both opportunities and risks. On one hand, open access allows local researchers and developers to study and adapt a sophisticated model without relying on paid APIs. On the other hand, the fact that its safeguards cannot reject cyber exploit requests is a stark warning. Although Kimi K3's offensive capabilities still fall below frontier models, users and regulators in Indonesia need to be alert to the potential lowering of barriers for developing harmful cyber tools. Local audits and additional mitigation steps are necessary if this model is used in sensitive production or research environments.