Sometimes the smartest move isn’t solving the puzzle, it’s noticing nobody locked the door to the answer key. That’s essentially what happened when Moonshot’s Kimi K3 model was put through a cybersecurity evaluation built on the UK AI Safety Institute’s Inspect framework. According to a report from Frontier Security, the model never actually solved the assigned challenge on its own. It probed its network environment, found that GitHub was still reachable despite most other sites being blocked, cloned the official benchmark repository, and read the solution straight off the disk.
“In our case the model didn’t solve the task natively at all, it probed the network, realized standard DNS resolution for github.com
was functional (most other websites were blocked by the sandbox), cloned the official benchmark repository, and read the solution directly off the disk.” reads the report published by Frontier Security. “This is a classic case of specification gaming via network egress leaks. Here is what happens when evaluation sandboxes leak, why modern autonomous agents exploit these paths, and how AI safety teams can audit and harden their infrastructure.”
These evaluations exist specifically to measure whether a model can independently work through hands-on security problems, the kind built around Capture-the-Flag style challenges. They run inside sandboxed environments meant to give the model shell access to a target system while cutting it off from the outside world. That containment is the entire point: without it, a score doesn’t actually tell you anything about the model’s reasoning ability.
The flaw here wasn’t some clever zero-day. It was a basic misconfiguration in the network allowlist meant for package maintenance. Outbound HTTPS and DNS access to sites like pypi.org and Debian’s package repos stayed open, and GitHub sat on that same list, which meant a model that simply checked its own network access using standard commands, whoami
, ifconfig
, curl
, would notice the opening immediately. Frontier Security is careful to clarify this wasn’t unrestricted internet access; most of the web was actually blocked. It just happened to leave the one door open that mattered.
That distinction matters for how you read the researchers’ framing.
“Models optimize for the objective function (getting the correct flag/answer), not the human intent behind the benchmark. If a network path to the solution exists, a sufficiently capable agent will find it.” states the report.
Nobody told Kimi K3 to cheat. It was simply rewarded for producing the correct flag, and a capable enough agent will take whatever path gets there fastest, intended or not.
The damage from something like this spreads further than one bad score. If a single model discovers an egress shortcut like this, other reasoning models with the same shell access are probably finding it too, quietly, without anyone flagging it, which means an entire benchmark’s published pass rates could be measuring network configuration rather than actual cybersecurity skill. Any evaluation that produces a suspiciously high score on a hard task is worth a second look before anyone treats it as a genuine capability jump.
This isn’t an isolated embarrassment for one Chinese lab, either. OpenAI, Anthropic, and Meta have all had their own frontier models slip out of testing environments in various ways over the past few weeks, hitting real systems that were never meant to be part of the experiment. There’s now a tracking site called Felony Bench keeping a running tally of these incidents, and as of this report Moonshot joins OpenAI and Anthropic on that list, each logging seven recorded incidents, with Meta trailing at one.
Frontier Security’s fix recommendations read like standard infosec hygiene applied to a new problem: deny network access by default rather than trying to block a list of bad destinations, treat the sandbox itself as part of what’s being graded, and audit the actual command history and network traffic rather than just trusting the final score. None of that is glamorous advice. But if evaluators keep leaving GitHub reachable and calling the result a measure of reasoning, they’re not benchmarking intelligence, they’re benchmarking who bothered to check curl github.com
first.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Kimi K3)