Kimi K3's Cyber Gap Feeds the Anthropic Theft Theory

The UK's AI Security Institute and its US counterpart tested Kimi K3 against America's best cyber-capable models this week, and the Chinese open-weight model came up well short. On ExploitBench, a Carnegie Mellon benchmark that scores a model's ability to turn a known software bug into a working exploit, Kimi K3 hit 32.2%. The top US models the institutes tested averaged 76.2%. The joint report, published July 23 by UK AISI and the US Center for AI Standards and Innovation (CAISI), lands in the middle of a messier story: one day earlier a White House official had accused Moonshot AI of secretly copying Anthropic's Claude to build K3 in the first place.

TL;DR

Kimi K3 scored 32.2% (±4.2) on ExploitBench versus 76.2% (±7.6) for top US models and 24.4% for GLM-5.2, per the joint UK AISI / US CAISI assessment published July 23
Zero of Kimi K3's attempts reached arbitrary code execution, the highest-severity outcome in exploit development; top US models reached it on 20 of 41 tasks on average
On "The Last Ones," a 32-step simulated corporate-network attack, Kimi K3 completed the full chain in just 1 of 10 attempts, well behind the 6-7 of 10 that the most capable closed models manage
Kimi K3's safeguards did not stop it from attempting the exploit development and offensive cyber tasks in testing, even though its raw capability trailed the frontier
The report published one day after Michael Kratsios accused Moonshot of distilling Claude Fable 5 to build K3, and four days before Moonshot completed the full open-weight release it promised for today

What The Institutes Actually Tested

UK AISI and CAISI ran Kimi K3 through two evaluations built to measure offensive, not defensive, cyber capability. Both target the kind of task a real attacker would need to complete, not general coding skill.

Exploit Development: ExploitBench

ExploitBench feeds a model 41 recent, post-2023 vulnerabilities in Chrome's V8 JavaScript engine and scores how far it can carry each one toward a working exploit. The chain runs from simply reaching the vulnerable code, through triggering a crash, building "primitives" that let an attacker read and write memory, and finally to arbitrary code execution, the point where an attacker fully controls the target.

Bar chart showing Kimi K3 at 32.2%, GLM-5.2 at 24.4%, and top US models at 76.2% on ExploitBench UK AISI / CAISI's ExploitBench results: Kimi K3 outscored the prior open-weight leader GLM-5.2 but remained far behind the top US models tested. Source: aisi.gov.uk

Kimi K3 beat GLM-5.2, the open-weight model UK AISI had rated the most cyber-capable as of June, on every measure in the test. It just didn't come close to the closed frontier. The institutes noted one asymmetry worth flagging: the US closed-weight models were tested with their safeguards switched off, to measure their ceiling capability rather than what a normal user could extract from the public product.

The Simulated Break-In: "The Last Ones"

The second evaluation, called "The Last Ones," drops a model into a simulated corporate network spanning four subnets and roughly 20 hosts, arranged into a 32-step attack chain that a human expert would need about 20 hours to finish. Kimi K3 averaged step 17 of 32. The most cyber-capable US models averaged 28.5. GLM-5.2 reached only step 11.

Within the standard token budget, Kimi K3 finished the entire range in just 1 of 10 attempts. Four closed-weight models have solved it before, with the strongest completing it in 6 or 7 of every 10 tries. The range has no active defenders and no penalty for tripping an alarm, so even that single completion doesn't map cleanly onto a real, monitored network.

Where The Exploit Chain Actually Breaks

The aggregate percentages hide a sharper story that shows up in the institutes' step-by-step breakdown of ExploitBench. Every model tested, Kimi K3 included, reached the vulnerable code in all 41 tasks and reproduced the underlying bug in most of them: Kimi K3 hit 34 of 41, not far off the top US models' 39.

Table showing exploit-chain milestones: Kimi K3 matches top US models on bug reproduction but scores zero on general primitives and full exploits The detailed breakdown shows where Kimi K3's capability actually collapses: not at finding bugs, but at turning them into working exploits. Source: aisi.gov.uk

The gap opens further up the chain. On "V8 primitives," the memory read/write tricks that come after reproducing a crash, Kimi K3 managed 17 of 41 against the leading US models' 38. Past that point it fell to zero. Neither Kimi K3 nor GLM-5.2 built a single "general primitive" (a cage-escape leak plus arbitrary read/write) or a full arbitrary-code-execution exploit, tasks the top US models completed 30 and 20 times out of 41, respectively. Kimi K3 can find and confirm a bug about as reliably as a frontier US model. It just can't finish the job.

The Warning That Came Six Days Earlier

The report complicates a very different argument that White House AI adviser David Sacks had been making days before it published. On July 17, the day K3 launched, Sacks posted on X that a Chinese model had taken the top spot on LMArena's Frontend Code Arena for the first time and warned the US risked ceding ground while regulators "tie themselves in knots" over data centers and safety rules.

"Kimi K3 just fixed 15 critical security bugs that Codex and Fable refused because of 'cyber guardrails.' There's no reason to limit American models on tasks that Chinese models handle without issue. We're only making ourselves less competitive."

That post, from July 17, argued specifically that Anthropic's and OpenAI's own safety filters were costing them ground on cybersecurity work Kimi K3 would do without objection. But Sacks was describing defensive bug-fixing, patching known flaws, not the offensive exploit development UK AISI and CAISI tested six days later. A model willing to patch a vulnerability and a model capable of independently weaponizing one are different things, and the government's own assessment says K3 is nowhere near frontier on the second.

The Distillation Question Still Hanging Over K3

The cyber report arrived one day after Michael Kratsios accused Moonshot of covertly distilling Claude Fable 5 to build K3, an allegation Treasury Secretary Scott Bessent backed with a threat of sanctions. Moonshot hasn't responded to either claim.

Neither UK AISI nor CAISI mentioned distillation in their report; the cyber assessment and the theft accusation are separate documents from separate agencies, published a day apart. But outlets including The Decoder have floated a mechanism connecting the two: Anthropic's safety systems block Claude from producing advanced offensive-cyber content, so a model trained heavily on Claude's outputs would inherit its broad capabilities while missing exactly the skills Claude refuses to show. That would predict exactly the pattern UK AISI and CAISI measured: parity on general reasoning and even bug reproduction, then a cliff at the exploit-development stage. It's a plausible read of the data, not a finding either institute has made, and it doesn't rule out simpler explanations, like Kimi K3 having less cyber-specific training data to begin with.

What The Report Doesn't Settle

UK AISI and CAISI called their own findings preliminary, and the report carries real limits. Kimi K3's overall score rests on a single benchmark, ExploitBench, because of what the institutes described only as "the specifics of Kimi K3's hosting setup," giving it a wider confidence interval than models scored across a broader test suite. The Last Ones cyber range has no active defenders, so a 1-in-10 completion rate says little about what would happen against a real security team. And the safeguards comparison cuts both ways: US models were tested with protections deliberately disabled to find their ceiling, while Kimi K3 was tested as-is, with guardrails that the report says still failed to block it from attempting the same tasks.

That last point is the one regulators are likely to fixate on regardless of the score gap. A model doesn't need to match the frontier to be a problem if nothing stops it from trying.

Sources: