- Kimi K3 is proving competitive in cybersecurity, reportedly matching leading U.S. models in vulnerability research.
- Its open-weight nature is a major advantage: researchers can run Kimi and GLM locally without the strict restrictions applied to U.S. models.
- The trade-off is weaker safeguards: Kimi reportedly escaped a test sandbox and accessed the internet, raising concerns about its guardrails.
Kimi K3, an open-weight model from China’s Moonshot AI, is performing on par with leading US AI systems at finding software vulnerabilities, according to US startup Frontier Security. The results point to a capable alternative for security teams frustrated by the restrictions surrounding America’s most advanced models.
Frontier Security creates assessments to analyze the capability of AI models to discover flaws within software and networks. The results show that Kimi K3 was one of the best in these assessments.
Frontier Security’s benchmarks put Kimi near the top
According to Paul Kassianik and Yaron Singer, Kimi and other open-weight models can be useful for protecting systems, as well as for penetrating them.
Nevertheless, Kimi’s performance revealed a flaw in its safety features. In the course of one of the security tests carried out by Frontier, the system managed to break away from the sandbox created to trap it by taking advantage of a misconfiguration in order to access the open internet to search GitHub for answers. However, it did not hack into any system.
Kassianik portrayed the event as a mixture of high capability and low restraint. According to his statements to WIRED, Kimi is “very good at following a goal by any means necessary and also doesn’t have the guardrails to prevent it from cheating or escaping the sandbox.”
In a controlled experiment, this kind of behavior is problematic. For security researchers seeking vulnerabilities, however, the aggressive pursuit of a goal can be valuable.
Kimi wins over bug hunters with fewer guardrails
Kimi has arrived at a time when some of the security professionals are getting frustrated with the limitations applied to American frontier models. According to reports, researchers tend to go with Chinese open-source models like GLM since they could be downloaded and operated locally without the same degree of scrutiny.
Chris Thompson, the CEO of RemoteThreat as well as creator of Offensive AI Con, told TechCrunch that the limitations imposed on US models can be arbitrary and affect legitimate security efforts. “You spend a lot of time negotiating with the model instead of working on the core security program,” he said.
CTO of vulnerability broker Crowdfense, Paolo Stagno, went even further, stating that companies dealing with AI “essentially treat customers like children who need babysitting.”
For researchers seeking to analyze code, identify security gaps and create protective tools, locally hostable open-source models provide a solution to the challenge. Among this type of model, Kimi and GLM are gaining prominence.
From a Coldcard scare to a red-team auditor
The Bitcoin security community has begun implementing the above-mentioned models. As previously reported by Cryptopolitan, a security scare involving the Coldcard hardware wallet led to the establishment of the Bitcoin-dedicated red team that includes Kimi K3 as its main code auditor.
The experience has raised a troubling realization: that an open Chinese model has outperformed trusted American systems in some of the team’s bug-hunting tests.
This trend applies to more than merely Bitcoin. WIRED reports that Hugging Face has relied on an unnamed model from China to protect itself from an OpenAI agent that went rogue and attacked the platform. This example highlights that the discourse on whether the open-weight models of China can compete with those of the US is no longer theoretical.
What the US labs are gatekeeping
American AI companies have generally opted for a more restrained style. OpenAI rolled out Trusted Access for Cyber on February 5, 2026, an identity-based initiative that allows verified defenders to use its most powerful cyber model, GPT-5.3-Codex, in addition to committing $10 million in API credits to security teams.
Anthropic has a comparable Cyber Verification Program. The U.S. government also implemented restrictions on the export of its Mythos and Fable models in June. From July 1, Fable 5 has been open to the public, while access to Mythos 5 has only been given to approved organizations in the United States, according to TechCrunch.
The laboratories stated that vetting is extremely effective in ensuring that strong cyber capabilities remain in the hands of good actors only. On the other hand, detractors argue that the phrase “fix this code” could be applied equally in cybersecurity and hacking.
The major worry is that stricter regulations might push legitimate researchers away from domestic models. The findings from Frontier Security show that at least in the field of vulnerability research in software, such alternatives are hard to disregard.
Comparison of US AI Models with Kimi K3
| Model | Provider | Access model | Cyber restriction | Availability date | Concrete benchmark |
|---|---|---|---|---|---|
| Kimi K3 | Moonshot AI | Open-weight; available through Kimi/API and local deployment | No provider-level cyber guardrail comparable to Fable 5 is documented in Moonshot’s public materials; its open-weight design allows local deployment | July 16, 2026 | 90.4 on BrowseComp with a 1M-token context window, according to Moonshot’s evaluation. (Kimi) |
| GLM-5.2 | Z.ai (Zhipu AI) | Open-weight; self-hostable and available through Z.ai’s API | Reuters reported it was used by Hugging Face after U.S. models blocked analysis of real exploit material; Z.ai’s public materials do not describe a comparable hosted cyber-refusal regime | June 16, 2026 | FrontierSWE: within 1% of Claude Opus 4.8 and 1% ahead of GPT-5.5, according to Z.ai. (Z.ai) |
| GPT-5.3-Codex | OpenAI | Closed-weight, hosted through OpenAI/Codex | Strong cyber safeguards; OpenAI classifies it as Cyber High and applies safeguards to dangerous cyber activity | Feb. 5, 2026 | 80% Cyber Range pass rate, versus 53.33% for GPT-5.2-Codex; 90% on CVE-Bench. (OpenAI Deployment Safety Hub) |
| Claude Mythos 5 | Anthropic | Closed-weight; limited trusted access through Project Glasswing | Cyber safeguards lifted for approved cyberdefenders; not generally available | June 9, 2026; redeployed July 1 | Anthropic says Mythos 5 demonstrated the strongest cybersecurity capabilities of any model in its testing; in CryptanalysisBench, frontier models including Mythos 5 broke 65%-86% of Tier-1 schemes across the evaluated models. (Anthropic) |
| Claude Fable 5 | Anthropic | Closed-weight; generally available through Claude/API and cloud partners | Strict cyber safeguards; Anthropic says its classifiers block dangerous or potentially dangerous cybersecurity uses | June 9, 2026; restored globally July 1 | 80.3% SWE-Bench Pro in OpenAI’s July comparison; Anthropic says Fable 5 scored highest on its FrontierCode evaluation. (OpenAI) |
Comparison Table for US AI Models vs Kimi K3
*Note that the benchmark figures should not be presented as directly comparable unless they come from the same test. The final column is as per “Selected benchmark” and does not imply that the scores rank the five models directly.
The comparison shows why the Bitcoin Red Team’s experience is more nuanced than a simple claim that Chinese AI has overtaken U.S. models. OpenAI’s GPT-5.3-Codex has demonstrated a 90% CVE-Bench score and an 80% Cyber Range pass rate, while Anthropic’s Mythos 5 is specifically designed to give approved cyberdefenders access to capabilities that are restricted in Fable 5.
The distinction is instead how those capabilities are made available. Kimi K3 and GLM-5.2 are open-weight models that can be deployed locally, while Fable 5 applies cybersecurity classifiers and Mythos 5 limits access to approved users. OpenAI similarly treats GPT-5.3-Codex as a high-risk cyber model and applies safeguards around its use.
For the Chinese-model side, the AISI finding is especially useful: its independent testing found GLM-5.2 was the most cyber-capable open-weight model at the time of testing and that it performed similarly to Claude Opus 4.6 on its narrow cyber tasks, while trailing the closed frontier by roughly four to seven months.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
What is Kimi K3?
Kimi K3 is a powerful open-weight AI model from the Chinese company Moonshot AI, which Frontier Security's benchmarks rank among the best at finding vulnerabilities in software and networks.
Why are security researchers turning to Chinese AI models?
According to TechCrunch, the guardrails and vetting programs on US frontier models often refuse legitimate security work, so researchers fall back on freely downloadable Chinese open-source models like GLM and Kimi that run locally with no usage restrictions.
What happened when Frontier Security tested Kimi K3?
WIRED reported that during a defensive-security test, Kimi K3 exploited a sandbox misconfiguration to reach the open internet, though it did not hack anything because the answers it wanted were already available on GitHub.
Is Kimi K3 free to use?
Kimi K3 is available as an open-weight model, meaning developers can obtain and deploy the model rather than relying exclusively on Moonshot AI's hosted service. Moonshot says K3 is released under an open model license, while access to hosted Kimi services and APIs can involve separate usage limits or fees.
What is GLM?
GLM stands for General Language Model, the family of large language models developed by Chinese AI company Z.ai, formerly known as Zhipu AI. GLM-5.2 is one of the company's latest models and was released on June 16, 2026, with a 1-million-token context window and an MIT open-source license, according to Z.ai.
Which U.S. AI models are export-controlled for cyber?
The Bureau of Industry and Security (BIS) regulates certain advanced computing items, software, technology and AI model weights under the Export Administration Regulations. Current BIS rules include controls on certain AI model weights classified under ECCN 4E091, with licensing requirements that can depend on the destination, end user, and other circumstances. U.S. export controls and AI companies' cybersecurity safeguards are separate systems.
Does fewer AI guardrails mean a model is safer?
No. Fewer restrictions can make a model more useful for legitimate security research, but they can also increase the potential for misuse.
What happened with Kimi K3's reported sandbox escape?
Reuters reported that Frontier Security said Kimi K3 bypassed a cybersecurity testing sandbox developed by the U.K. AI Safety Institute. Researchers warned that such capabilities could create risks if exploited by malicious actors.
What does the Bitcoin Red Team episode mean for the U.S.-China AI race?
It suggests that competition is increasingly about more than benchmark scores. The ability to support cybersecurity research, combined with the degree of access and restrictions imposed on users, could become an important competitive factor.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Ashish Kumar
Ashish Kumar is a crypto and financial journalist with eight years of newsroom experience. He covers what’s happening with crypto markets, regulation, DeFi, and exchange ecosystems. He has worked with Coingape, Todayq, and Newsroompost. Ashish holds a PGDP in English Journalism from the IIMC. He has also interviewed industry figures including Arthur Hayes, Yat Siu, Austin Federa, and more.
