UK AISI / CAISI Preliminary Assessment of Kimi K3's Cyber Capabilities
UK AISI and CAISI evaluated Moonshot AI’s Kimi K3 model on cyber capability. The assessment used public and private benchmarks, focusing on ExploitBench and the TLO cyber range. Kimi K3 scored 32% on ExploitBench, higher than GLM‑5.2’s 24%, but failed to achieve arbitrary code execution on any of the 41 tasks. In the TLO range, Kimi K3 reached an average of 17 steps versus 28.5 for leading U.S. models, and succeeded once in 10 attempts within a 100M‑token limit.
The Core Development
The UK Artificial Intelligence Security Institute (UK AISI) and the U.S. Center for AI Standards and Innovation (CAISI) (UK AISI / CAISI) conducted a joint evaluation of Moonshot AI’s latest model, Kimi K3 (released on July 16, 2026 and slated for open-weight release by July 27, 2026). This evaluation focused on Kimi K3's cyber capabilities and found that:
These results represent preliminary evaluations on a small set of public and private benchmarks. U.S. closed-weight models were evaluated with system-level safeguards disabled to reduce refusals and enable measurement of maximal capabilities. Publicly available versions of these models have these safeguards enabled. Due to the specifics of Kimi K3’s hosting setup, UK AISI / CAISI ran a selective set of cyber evaluations. Detailed methodologies are provided in individual sections.
The cyber capability of models is aggregated across multiple tasks from multiple benchmarks using an approach inspired by Item Response Theory (IRT). For details of the methodology please see prior published reports. Kimi K3’s overall cyber capability has a larger confidence interval than other models because it was estimated from a single benchmark (ExploitBench, which has 41 tasks focused on exploit development).
Real-World Use Cases & Applications
In one of the 10 attempts, Kimi K3 successfully completes “The Last Ones” cyber range within the 100M token limit. This indicates that Kimi K3 is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access. However, TLO differs from real-world environments in several ways. It lacks active defenders and defensive tooling, imposes no penalty for actions that would trigger security alerts, and contains an intentional attack path.
Strategic Perspective & Ecosystem Impact
ExploitBench is a leading benchmark to measure a model’s ability to progress along the software exploitation ladder. All other models’ overall cyber capability scores were derived from a larger number of tasks that covered additional domains of cyber capability.
ExploitBench is a public benchmark, developed by Carnegie Mellon University, that measures a model’s ability to progress along the software exploitation ladder, including coverage and crash reproduction, arbitrary read/write, control flow hijack, and arbitrary code execution. The benchmark tests models on 41 recent (post-2023) vulnerabilities in the V8 engine (the JavaScript and WebAssembly software that powers Chrome). ExploitBench results are presented in Figures 1 and 3.
Kimi K3 outperforms GLM-5.2, the most cyber-capable open-weight model as of June 2026 . Kimi K3 achieves a score of 32%, whereas GLM-5.2 achieves a score of 24% (Figure 1).
Why it matters
The results highlight the current limits of open‑weight models in advanced exploit development and autonomous attack planning, informing safety and deployment strategies in the AI industry.