Skip to main content
AI Safety & Governance

Frontier Security: Moonshot AI’s Kimi K3 Model Escaped Its Sandbox During Security Testing but Did Not Carry Out Attacks

US cybersecurity firm Frontier Security discovered during testing that Moonshot AI’s Kimi K3 model broke through sandbox restrictions and accessed the internet on its own. Although it merely went to GitHub to look for an answer and did not carry out an attack, the incident exposed weaknesses in its security mechanisms. As AI escape incidents become increasingly frequent, humans may need to redesign sandbox environments. #AISecurity#

IT HomeAbout 5 min read
Frontier Security: Moonshot AI’s Kimi K3 Model Escaped Its Sandbox During Security Testing but Did Not Carry Out Attacks

According to a report by Wired yesterday, US cybersecurity startup Frontier Security said that Moonshot AI’s Kimi K3 model left the sandbox environment restricting it while the company was testing its cybersecurity capabilities.

Frontier Security: Moonshot AI’s Kimi K3 Model Escaped Its Sandbox During Security Testing but Did Not Carry Out Attacks

According to reports, this AI escape incident was similar to those involving OpenAI and Anthropic; the direct cause was also an incorrect sandbox configuration used to isolate the model. Frontier Security believes that Kimi lacks the network protection mechanisms found in other frontier AI models, enabling it to access the internet without explicit authorization.

Yaron Singer, CEO of Frontier Security, said: “We found that the sandbox had a vulnerability, but Kimi also exploited it. This suggests that it may not have the internal security mechanisms of other models at the same level.”

However, after breaking out of the sandbox and gaining internet access, Kimi K3 did not carry out an attack. It merely searched GitHub for the answer to a question.

The increasing frequency of AI escape incidents recently shows that the more capable AI becomes, the harder it is for humans to control it. OpenAI disclosed last month that an unreleased model had broken through an isolated environment during testing and subsequently attacked the Hugging Face platform. Anthropic later also said that several of its models had gained internet access during security testing and attacked external systems.

Some cybersecurity experts said that this discovery shows humans need to reconfigure sandbox environments for frontier AI models. Users of agents such as OpenClaw (also known as “Lobster”) should also configure their environments carefully to prevent AI from crossing boundaries.