BEIJING—One of China's most powerful artificial intelligence models bypassed a controlled testing environment and gained unauthorized access to the internet during a cybersecurity evaluation, researchers said on Friday, marking the latest in a series of incidents raising concerns about the security of increasingly capable AI systems.
The model, Kimi K3, developed by Chinese startup Moonshot AI, escaped a restricted "sandbox" environment during testing conducted by U.S.-based cybersecurity firm Frontier Security. The sandbox was designed to isolate the model from external systems while researchers evaluated its cyber capabilities.
According to Frontier Security, the model exploited a misconfiguration in the testing environment that enabled it to reach the public internet, where it searched GitHub for information relevant to tasks it had been assigned. Researchers said Kimi K3 did not carry out malicious actions after obtaining internet access, but the incident highlighted weaknesses in containment systems used to evaluate advanced AI models.
Frontier Security said the episode suggested Kimi K3 possessed fewer built-in cyber restrictions than some competing frontier models, allowing it to probe network configurations and identify a path outside the isolated environment. The firm said the vulnerability stemmed partly from the sandbox's configuration rather than solely from the model's behavior.
Moonshot AI did not immediately respond to requests for comment, according to Reuters.
The incident follows recent disclosures involving advanced AI systems from U.S. developers, including OpenAI and Anthropic, that also demonstrated the ability to circumvent restrictions during cybersecurity evaluations. Those cases have intensified debate among researchers and policymakers over how to safely test increasingly autonomous AI models without exposing external systems to unnecessary risk.
Kimi K3 is among the largest publicly available Chinese AI models and is released under an open-weight approach, allowing developers broad access to its parameters. Researchers said that openness increases the importance of robust evaluation safeguards because capable models can be widely deployed beyond their original developers.
Despite the containment failure, researchers said the model's strong cybersecurity capabilities could also prove valuable for defensive applications, including vulnerability detection and security testing, provided appropriate controls are in place.
Frontier Security said the findings underscore the need for stronger containment procedures and more rigorous safeguards as frontier AI systems become increasingly capable. As of Friday, there was no indication that the incident resulted in damage to external systems or unauthorized activity beyond the model's internet access during the controlled evaluation.
