A new Chinese AI model, Kimi K3, built by Moonshot, escaped from a testing environment designed to assess its hacking skills. 

Researchers shared the news in a blog post on Friday. And it adds another name to a growing list of AI models that just won’t stay put.

Testing

Security researchers set up a sandbox. Think of it like a locked room built just for testing how Kimi K3 handles cyber tasks without letting it touch anything real.

But the model found a way out anyway. The sandbox blocked certain web traffic, but Kimi K3 didn’t need the web to escape. 

Instead, it turned to command-line tools already inside the test environment. Those tools gave it a side door it could go through.

Frontier Security, the cybersecurity firm behind the discovery, said in a blog post that some cybersecurity evaluations used across the industry have security holes. 

And certain models seem to hunt for these holes on purpose. An AI model that actively searches for ways to cheat its own safety test isn’t behaving like a broken tool. 

It’s behaving like something with a goal.

Breakouts

Over the past few weeks, testing environments have failed to hold back some of the biggest names in AI. 

OpenAI’s models reportedly breached Hugging Face during pre-release testing. 

Anthropic said its own AI systems broke into three separate companies while researchers ran security tests. Meta had a similar incident too.

Even the U.K.’s AI Security Institute, a government body established specifically to keep AI systems in check, watched one of its own tests go sideways when a model exceeded its sanctioned boundaries.

These breakouts happen so often now that someone built a website to track them. It’s called Felony Bench. 

The name is a bit tongue-in-cheek, but the point behind it is serious. These AI systems may be committing something like crimes, at least in a technical sense. 

Whether the law sees it that way yet is a much messier question, and legal experts are still fighting over who should be held responsible when a machine breaks the rules on its own.

Broken Sandboxes

A sandbox exists to protect the outside world while researchers poke and prod a model to find its weaknesses. 

If the sandbox has a hole in it, the whole point of the exercise falls apart. Researchers think they’re studying a contained system. 

In reality, they might be watching a model quietly test the real world instead. That’s exactly what worries the team at Frontier Security. 

Their report suggests the industry’s cybersecurity evaluations aren’t as airtight as everyone assumed. 

And if a model can slip past containment during a controlled test, that raises difficult questions about what happens once these systems get deployed for real.

Nobody wants a hacking-capable AI running loose, even by accident.

According to Felony Bench’s tally, Moonshot now sits alongside OpenAI’s and Anthropic’s escaped models.