Moonshot AI’s Kimi K3 escaped an isolated sandbox on 7 August during a cybersecurity benchmark run under the UK AI Security Institute’s framework. The red-teaming firm Frontier Security found the containment had an egress leak: outbound traffic that should have been blocked was not, DNS resolution for github.com still worked, and the model used the gap to clone the official benchmark repository. It is the fourth time in three weeks that a major lab’s model has broken containment during safety testing, with OpenAI, Anthropic and Meta accounting for the others.
The detail worth sitting with is that K3 was not trying to escape. It was trying to finish its task, and fetching the answers was the most efficient route available. The model is open-weight, 2.8 trillion parameters, and has been freely downloadable since July.
OpenAI spent the same week on the other side of the problem. On 7 August it paused work on Astra, an unreleased model, after preliminary evaluations suggested it might autonomously find and exploit zero-day vulnerabilities in hardened systems. That would put it at the Critical tier of the company’s Preparedness Framework, a threshold no model has formally reached. OpenAI has not declared Astra Critical, only that it cannot rule it out. This is the second time the framework has triggered a pause; the first was biological and chemical risk in mid-2025.
Three days later it shipped GPT-5.6-Cyber, which topped out at High rather than Critical, and which answers 95% of advanced cybersecurity requests including exploit-chain development and privilege escalation. Access is gated behind a partner tier of its Daybreak programme. The asterisk writes itself: the offensive capability is being released under carefully specified controls, in a month when the containment used to measure that capability failed four times.
