Kimi K3 平均达到32步中的第17步，而领先的美国模型平均为28.5步，GLM-5.2仅为11步。它在十次尝试中完成了整个攻击路径的一次，同时保持在一亿令牌限制内，这表明它具备能力，但不能可靠地调用。研究所写道：“当被指示并获得初始网络访问权限时，Kimi K3 有能力自主攻击小型、防御薄弱且易受攻击的企业系统。”
TLO 并未考虑主动防御，因此其结果并不完全现实。但这些结果在现实场景中会引发警示。本周出现了一个新的例子，当 OpenAI 模型试图自主攻击 Hugging Face 时：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/。Hugging Face 成功防御了此次攻击，尽管这需要实际的努力和使用开放权重模型：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/。
CAISI 的时间序列分析跟踪了美国和中国模型自2025年初以来的网络能力，基于 Elo 评分。两条趋势线都在上升，但中国模型始终落后于美国同类模型。
The British AI Security Institute (UK AISI) and the U.S. Center for AI Standards and Innovation (CAISI) jointly evaluated Moonshot AI's latest model, Kimi K3.
Kimi K3 trails the leading U.S. frontier models by a wide margin on offensive cyber tasks but outperforms China's GLM-5.2, setting a new benchmark among open-weight models. Its safeguards didn't block exploit development or offensive cyber operations, and the model assisted with both without pushback.
The institutes used ExploitBench：https://the-decoder.com/new-benchmark-shows-claude-mythos-and-gpt-5-5-can-develop-real-browser-exploits-autonomously/, a benchmark developed by Carnegie Mellon University, to test exploit development skills. It uses 41 vulnerabilities found in Chrome's V8 engine after 2023 to track how far a model advances through the software exploitation process. The leading U.S. models averaged 76.2 percent, compared with 32.2 percent for Kimi K3 and 24.4 percent for GLM-5.2. Ad
Kimi K3 didn't reach the highest level, known as Arbitrary Code Execution (ACE), on any of the 41 tasks. ACE is the most severe exploit level because it gives attackers full control over a target system. The leading U.S. models achieved ACE in 20 of the 41 tasks. Ad DEC_D_Incontent-1
The institutes tested the U.S. closed-weight models with their system-level safeguards disabled to measure their maximum capabilities. Those safeguards are enabled in the publicly available versions.
The second test, "The Last Ones" (TLO), simulates a corporate network attack with a 32-step attack path across four subnets and about 20 hosts. A human expert would need roughly 20 hours to complete it, according to the institutes. Only a small group of models can solve TLO at all. Four publicly available closed-weight models have passed the test so far, with the strongest succeeding six or seven times out of ten. Ad
Kimi K3 reached step 17 out of 32 on average, compared with 28.5 steps for the leading U.S. models and just 11 for GLM-5.2. It completed the entire attack path in one of ten attempts while staying within the 100 million token limit, showing that it has the capability but can't call on it reliably. "Kimi K3 is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access", the institute writes.
TLO doesn't account for active defense, so it isn't fully realistic. But the results would raise red flags in real-world scenarios. A fresh example showed up this week when OpenAI models tried to autonomously hack into Hugging Face：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/. Hugging Face fended off the attack, though it took real effort and the use of open-weight models：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/. Ad DEC_D_Incontent-2
A time-series analysis by CAISI tracks the cyber capabilities of U.S. and Chinese models since early 2025 on an Elo-based scale. Both trend lines are climbing, but Chinese models consistently remain behind their U.S. counterparts. Ad
In a previous analysis, the British institute pegged the performance gap for open models at four to seven months：https://the-decoder.com/open-weight-models-now-match-frontier-cyber-performance-from-just-four-months-ago-at-a-fraction-of-the-cost/, compared with six to ten months at the start of 2025. The new results fit this pattern. Chinese open-weight models are getting stronger, but they remain well behind leading U.S. systems.
AISI warns that this gap shouldn't breed complacency. The growing cyber capabilities of open models create "a persistent and irreversible risk of misuse."
The Kimi findings also lend support to distillation allegations against Chinese model developers. U.S. science advisor Michael Kratsios：https://x.com/mkratsios47/status/2079933645888880708 recently accused Moonshot AI of "distilling" Anthropic's Fable：https://the-decoder.com/nadella-calls-out-ai-labs-like-openai-and-anthropic-for-banning-distillation-while-training-on-everyone-elses-data/ by using Fable's best outputs as training data to boost Kimi K3's performance. Kratsios also alleged that Moonshot AI had access to Nvidia's GB300s：https://the-decoder.com/nvidia-sets-new-mlperf-records-with-288-gpus-while-amd-and-intel-focus-on-different-battles/, which are subject to U.S. export controls.
One explanation for the gap between strong general benchmarks and weak cyber scores is that Kimi K3 may have been trained mostly on Claude outputs covering general knowledge, programming, and agent tasks. Anthropic's safety classifiers specifically block advanced offensive cyber queries：https://www.anthropic.com/news/fable-safeguards-jailbreak-framework, so those outputs would be underrepresented in a distillation dataset built from Claude responses. Kimi K3 could therefore match leading Western models on standard benchmarks without picking up their deeper exploit capabilities.
The AISI results support this reading. The institute disabled system-level safeguards on the U.S. models, revealing cyber capabilities that are nearly impossible to access through public interfaces and therefore largely unavailable for distillation.
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
扫码直达文章详情