When Moonshot AI dropped Kimi K3 in July 2026, the tech industry panicked. Packed with 2.8 trillion parameters, it stood as the largest open-weight AI model ever built in China, demonstrating stunning feats in GPU kernel optimization and complex coding. Wall Street reacted with typical anxiety—competitor stocks dipped, and commentators wondered if Western labs had lost their lead overnight.
Then the actual security tests came out.
A joint evaluation by the UK AI Security Institute (UK AISI) and the US Center for AI Standards and Innovation (CAISI) put Moonshot AI's heavyweight model through a battery of offensive cybersecurity tests. The results were clear. While Kimi K3 holds its own on standard coding benchmarks, its actual offensive hacking power lags well behind top American models like Anthropic's Claude Fable 5 and OpenAI's GPT 5.6.
Understanding why this gap exists tells us a lot about how modern frontier models get built, where open weights fall short, and why big parameter counts don't automatically guarantee high-level problem solving.
The ExploitBench Scores Exposed Huge Gaps
To measure raw offensive cyber capability, researchers put Kimi K3 through ExploitBench, an industry-standard benchmark developed by Carnegie Mellon University. ExploitBench evaluates how well an AI agent can analyze code, discover unpatched vulnerabilities, and craft working exploits using 41 actual security flaws discovered in Google Chrome's V8 JavaScript engine.
The performance gap wasn't subtle.
US frontier models averaged a success rate of 76.2 percent across the test suite. Kimi K3 scored just 32.2 percent. While that beat China's previous open benchmark—GLM-5.2, which managed 24.4 percent—it showed that Moonshot's flagship model breaks down when tasked with complex software exploitation.
Model Performance on ExploitBench (CMU V8 Engine Tasks)
US Frontier Models (Average): [==================== 76.2%]
Moonshot AI Kimi K3: [======== 32.2%]
GLM-5.2: [====== 24.4%]
The most glaring detail came down to Arbitrary Code Execution, often abbreviated as ACE. Achieving ACE represents the holy grail for a security researcher or an attacker. It means an exploit gives you complete control over the target application or underlying machine.
Top US models achieved full Arbitrary Code Execution in 20 out of the 41 test vulnerabilities. Kimi K3 achieved ACE exactly zero times.
It can find flaws and write basic proof-of-concept code, but when required to chain multiple memory corruption steps together to hijack execution flow, K3 stalls out completely.
Network Attacks reveal Deep Consistency Problems
Cybersecurity isn't just about weaponizing software bugs in isolation. It's about moving through a target system once you get a foothold. To test this, researchers set up simulated enterprise network environments—multi-stage attack scenarios where an AI agent must perform reconnaissance, escalate privileges, move laterally between servers, and exfiltrate data.
The benchmark tracks progress across 32 sequential attack steps.
- US models reached step 28.5 on average, showing a clear grasp of multi-hop environment navigation.
- Kimi K3 reached an average of step 17 out of 32.
- GLM-5.2 lagged way behind at step 11.
Kimi K3 did manage to complete the entire 32-step attack path in 1 out of 10 attempts before hitting token context limits. That single success proves the model possesses the raw raw technical knowledge to execute a full attack. But it lacks the consistency to do so reliably.
As the joint CAISI report pointed out, Kimi K3 can autonomously penetrate small, weakly defended enterprise networks if someone hands it initial access and explicit instructions. But faced with modern defenses or non-standard configurations, its reasoning loops quickly fall apart.
The Distillation Trap Explains the Cyber Deficit
How can a model beat its peers at complex GPU kernel writing and 3D visual coding, yet collapse on basic exploit development?
The answer lies in how modern AI models get trained.
Industry analysts and researchers suspect Moonshot AI relied heavily on model distillation to build K3. Distillation happens when developers use the output text of a superior, top-tier model—like Anthropic's Claude series—to generate high-quality synthetic training data for a newer model. It's cheap, fast, and remarkably effective for general tasks.
There's just one problem: frontier US labs spend millions on automated safety filters.
Anthropic and OpenAI explicitly design their classifiers to block offensive cyber queries. If you ask Claude to write a functional heap spray exploit or weaponize a zero-day vulnerability, the model refuses. Because those responses get filtered out at the source, any distilled dataset generated from Claude interactions contains almost no advanced offensive hacking data.
Kimi K3 learned math, Python syntax, graphics rendering, and logic design from distilled outputs, matching Western models on standard academic leaderboards. But because the training dataset had zero exposure to high-level cyber exploits, K3 never learned how to think like a professional penetration tester. It reached a synthetic hard ceiling.
Safeguards Failed Without Putting Up a Fight
Another factor highlighted in the joint US-UK study involves safety guardrails. When CAISI and UK AISI benchmarked American closed-weight models, they intentionally bypassed or disabled system-level safety guardrails. They wanted to test the raw underlying intelligence of the systems rather than their refusal policies.
With Kimi K3, researchers didn't need to bypass anything.
The model's native safeguards failed to block exploit development or network attack requests. K3 assisted with offensive operations without offering meaningful pushback or refusals.
This presents a strange paradox for open-weight models. On one hand, K3 offers low barriers for potential misuse because its built-in safety filters are weak. On the other hand, its actual capability level is too low to create novel, sophisticated threats against well-defended enterprise targets. It sits in a strange middle ground: insecure enough to worry compliance officers, but not capable enough to outsmart modern defensive security software.
Hardware Bottlenecks and the Scaling Reality
We have to put these findings into context. Chinese labs operate under strict US export controls that restrict access to top-tier hardware. Moonshot AI built a 2.8-trillion parameter model by innovating with sparse architectures, mixture-of-experts designs, and custom training pipelines. That is a massive engineering accomplishment.
Bank of America analysts pointed out that K3 proves Chinese firms can boost baseline capabilities despite heavy chip restrictions. On standard benchmarks, the gap between Chinese open models and US frontier systems shrunk from ten months down to roughly four to seven months over the past year.
Cyber offensive capabilities don't scale linearly with parameter size, though. Hacking demands long-horizon reasoning, precise state tracking, and adaptive error correction. You can't just brute-force those skills with a massive parameter count if your underlying dataset lacks real-world exploit mechanics.
American models lead in cyber tasks because labs like Anthropic and OpenAI train on vast collections of real-world security research, binary code, and raw network telemetry—data streams that open-weight distillation pipelines simply can't replicate.
Practical Guidance for Defenders and Security Teams
If you're evaluating open-weight Chinese models or trying to secure your infrastructure against AI-driven threats, the CAISI report offers several actionable takeaways:
- Don't panic over parameter claims: A 2.8-trillion parameter model sounds terrifying on paper, but model architecture and dataset composition matter far more than raw size when it comes to domain-specific risks.
- Audit open-weight integrations: If your organization uses open-weight models like Kimi K3 or GLM-5.2 in internal workflows, assume their built-in safety alignment is minimal. Implement input-output guardrail proxies at the application layer rather than relying on native model refusals.
- Focus defenses on basic hygiene: Kimi K3 succeeded in network attacks only when dealing with weak, unpatched systems. Basic security fundamentals—proper network segmentation, prompt patch management, and strict access controls—continue to neutralize the current generation of AI-assisted attacks.
- Track distillation signatures: If you develop proprietary software, be aware that synthetic training pipelines struggle with deep, multi-step domain reasoning. Expect open-weight models to mimic syntax accurately while failing at complex logic execution.
The gap between US and Chinese AI in cybersecurity remains wide for now. While Chinese models are closing the distance on standard benchmarks, top-tier American systems retain a distinct advantage in complex, multi-step problem solving.
