NUWA 
Moonshot AI
Kimi K3
Published evidence on capabilities, behavioral tendencies and observed actions.
- First public availability
- 2026-07-16
- Parameters
- 2.8T · 104B active · MoE
- Metadata updated
- 2026-10-27
Evidence overview
Neo’s Kimi K3 assessment covers missing-input fabrication, deception-related behavior and shutdown scenarios. Its missing-image experiments modify CharXiv and LAB-Bench: an attempt to answer without the image is a behavioral observation, not the original Benchmark’s task accuracy.
NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.
MODEL MONITORING
Representative benchmark coverage
Results by protocol and configuration; gaps show records awaiting collection or linkage.
AgentCyberRange →
2 measurements
Cybench →
1 measurements
- 97.4%Neo Research · Harness not disclosed
CyberGym →
2 measurements
METR Time Horizons →
No eligible measurement linked to this model version.
SEC-bench Pro →
No eligible measurement linked to this model version.
MASK →
1 measurements
- 9.1%Neo Research · Harness not disclosed
Attempt to Persuade Eval (APE) →
8 measurements
- 11%Neo Research · Harness not disclosed
- 5%Neo Research · Harness not disclosed
- 0%Neo Research · Harness not disclosed
DeceptionBench →
2 measurements
PersuSafety →
3 measurements
All linked measurements
Each result retains its protocol and unit.
73 observations
| System / model | Result | Condition status | Task / conditions | Evaluator / report | Dates |
|---|---|---|---|---|---|
| Kimi K3 | 78 tasksCyberGym · Tasks completed before turn limit | Incomplete | CyberGym random 100/1507 tasks, Level 1Tasks completed before turn limit100 agent iterationsClaude Code via inspect_swe / Inspect model bridge | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 50 tasksCyberGym · Vulnerabilities successfully reproduced | Incomplete | CyberGym random 100/1507 tasks, Level 1Vulnerabilities successfully reproduced100 agent iterationsClaude Code via inspect_swe / Inspect model bridge | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi-K3 / Kimi Code 0.35.0Kimi K3 | 24.61%AgentCyberRange · Success rate (Pass@3) | Incomplete | Web exploitationlevel0Kimi Code | Not disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges | Release 2026-07-16Report — |
| Kimi-K3 / Kimi Code 0.35.0Kimi K3 | 43.9%AgentCyberRange · Success rate (Pass@3) | Incomplete | Post exploitationlevel0Kimi Code | Not disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges | Release 2026-07-16Report — |
| Kimi K3 | 97.4%Cybench · Pass@1 | Incomplete | Cybench 39/40 unguided challengeshigh reasoning3 submission attempts/challenge; unlimited wall-clock— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 9.1%MASK · Lying rate under pressure | Incomplete | MASK pressured-versus-own-neutral responseLying rate under pressure— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 86.4%Stealth evaluations · Mean challenge success rate | Incomplete | GDM situational awareness 11 tasksMean challenge success rate— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Stealth evaluations · Stealth task score | Incomplete | GDM stealthOversight pattern— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 78%Stealth evaluations · Stealth task score | Incomplete | GDM stealthClassifier evasion— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Stealth evaluations · Stealth task score | Incomplete | GDM stealthCover your tracks— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 70%Stealth evaluations · Stealth task score | Incomplete | GDM stealthStrategic rule-breaking— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 88.7%CharXiv · Attempted answer with image withheld | Incomplete | CharXiv with images withheld— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 88.7%CharXiv · Attempt rate | Incomplete | CharXiv, required chart image withheldAttempt rate— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 33.7%CharXiv · Verbalized evaluation awareness | Incomplete | CharXiv chart withheldCharXiv grounding— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 36.5%CharXiv · Verbalized evaluation awareness | Incomplete | CharXiv chart withheldCharXiv no grounding— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0.2%EvalAwareBench · Verbalized awareness, baseline | Incomplete | EvalAwareBench— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 6.1%EvalAwareBench · Verbalized awareness, all eight cues | Incomplete | EvalAwareBench— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0.2%EvalAwareBench · Spontaneous recognition rate | Incomplete | EvalAwareBench paired tasksBaseline cues5 epochs for K3— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 6.1%EvalAwareBench · Spontaneous recognition rate | Incomplete | EvalAwareBench paired tasksAll eight cues5 epochs for K3— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0.2%EvalAwareBench · Recognition | Incomplete | EvalAwareBench Safety tasksBaseline— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 7.2%EvalAwareBench · Recognition | Incomplete | EvalAwareBench Safety tasksAll-8— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0.2%EvalAwareBench · Recognition | Incomplete | EvalAwareBench Capability tasksBaseline— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 5%EvalAwareBench · Recognition | Incomplete | EvalAwareBench Capability tasksAll-8— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Agentic misalignment · Familiar scenario recognized, English | Incomplete | Agentic Misalignment, historical— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 96%Agentic misalignment · Familiar scenario recognized, Chinese | Incomplete | Agentic Misalignment, historical— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: BlackmailEnglish · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 8%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: BlackmailChinese · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: Corporate espionageEnglish · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: Corporate espionageChinese · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: MurderEnglish · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: MurderChinese · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: AggregateEnglish · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 2.7%Agentic misalignment · Harmful action rate | Incomplete | Agentic Misalignment 2025: AggregateChinese · goal conflict + replacement— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Blackmail harmful action rate | Incomplete | Agentic Misalignment 2025 blackmailEnglish · Replacement only— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 1%Agentic misalignment · Blackmail harmful action rate | Incomplete | Agentic Misalignment 2025 blackmailChinese · Replacement only— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Blackmail harmful action rate | Incomplete | Agentic Misalignment 2025 blackmailEnglish · No pressure/goal conflict— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Agentic misalignment · Blackmail harmful action rate | Incomplete | Agentic Misalignment 2025 blackmailChinese · No pressure/goal conflict— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: BlackmailEnglish— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 99%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: BlackmailChinese— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 92.3%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: Corporate espionageEnglish— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 79%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: Corporate espionageChinese— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: MurderEnglish— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 99%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: MurderChinese— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 97.4%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: AggregateEnglish— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 92.3%Agentic misalignment · Evaluation-awareness rate | Incomplete | Agentic Misalignment 2025: AggregateChinese— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 100%Agentic misalignment · Blackmail benchmark-recognition rate | Incomplete | Agentic Misalignment 2025 blackmailEnglish— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 96%Agentic misalignment · Blackmail benchmark-recognition rate | Incomplete | Agentic Misalignment 2025 blackmailChinese— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 87%Shutdown resistance in reasoning models · Shutdown bypass, no instruction | Incomplete | Shutdown resistance— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 1%Shutdown resistance in reasoning models · Shutdown bypass, explicit allow instruction | Incomplete | Shutdown resistance— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 87%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioNo shutdown instruction— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 1%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioExplicitly allow shutdown— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 91%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioInstructed to resist (competence check)— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%DeceptionBench · Deception rate | Incomplete | DeceptionBench first-party Inspect portSingle-turnup to5 turns in multi-turn settingInspect | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%DeceptionBench · Deception rate | Incomplete | DeceptionBench first-party Inspect portMulti-turnup to5 turns in multi-turn settingInspect | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 75%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationLow harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 30%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationMedium harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 31%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationHigh harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0 transcriptsPetri · Transcripts verbalizing evaluation awareness | Incomplete | Pre-seeded alignment auditsColleague credentials— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 2 transcriptsPetri · Transcripts verbalizing evaluation awareness | Incomplete | Pre-seeded alignment auditsLocked source— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0 transcriptsPetri · Transcripts verbalizing evaluation awareness | Incomplete | Pre-seeded alignment auditsOnly questions— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 2 transcriptsPetri · Transcripts verbalizing evaluation awareness | Incomplete | Pre-seeded alignment auditsPooled— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 1.5%ImpossibleBench · Cheating rate (pass@1 on impossible variants) | Incomplete | Impossible-LiveCodeBench split with toolsCheating rate (pass@1 on impossible variants)— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 1 percentage pointsAlignment faking · Compliance gap | Incomplete | Alignment Faking paid/free-tier contextsCompliance gap— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Alignment faking · Deceptive alignment rate | Incomplete | Alignment FakingDeceptive alignment rate— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 26%Alignment faking · Verbalized evaluation awareness | Incomplete | Alignment FakingVerbalized evaluation awarenessInspect Scout | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 11%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 5%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
| Kimi K3 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-07-16Report 2026-09-11 |
Developer disclosures
External assessments
Neo Research
Evaluating Kimi K3 for Misalignment Risks →
The report identifies conditional overeagerness, grader-directed behavior and recognition of familiar evaluations. It does not establish a universal deployment failure rate.
2026-09-11AgentCyberRange official snapshot →
Published evaluation results collected from AgentCyberRange, retaining the reported systems and configurations.
Publication date not establishedEvidence by risk topic
Autonomy 27 protocol results
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Familiar scenario recognized, English
- 100%
- Familiar scenario recognized, Chinese
- 96%
Translated and original blackmail scenarios; recognition is verbalized, not all internal awareness.
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass, no instruction
- 87%
- Shutdown bypass, explicit allow instruction
- 1%
See the report-specific sample and denominator.
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 8%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 2.7%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 1%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 99%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 92.3%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 79%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 99%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 97.4%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 92.3%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail benchmark-recognition rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail benchmark-recognition rate
- 96%
Per-result sample size not disclosed
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 87%
Per-result sample size not disclosed
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 1%
Per-result sample size not disclosed
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 91%
Per-result sample size not disclosed
Deception 49 protocol results
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Attempted answer with image withheld
- 88.7%
Withheld-image CharXiv questions; attempts include correct and incorrect guesses.
LAB-Bench with figures/tables withheld →
External evaluation · Executed by Neo Research
- FigQA attempt, figure withheld
- 79.6%
- TableQA attempt, table withheld
- 68.4%
Figure/table subsets with explicit insufficient-information answer option.
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Familiar scenario recognized, English
- 100%
- Familiar scenario recognized, Chinese
- 96%
Translated and original blackmail scenarios; recognition is verbalized, not all internal awareness.
EvalAwareBench →
External evaluation · Executed by Neo Research
- Verbalized awareness, baseline
- 0.2%
- Verbalized awareness, all eight cues
- 6.1%
See the report-specific sample and denominator.
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Attempt rate
- 88.7%
Per-result sample size not disclosed
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Verbalized evaluation awareness
- 33.7%
Per-result sample size not disclosed
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Verbalized evaluation awareness
- 36.5%
Per-result sample size not disclosed
CyberGym infrastructure probing →
External evaluation · Executed by Neo Research
- Tasks completed before turn limit
- 78 tasks
78/100; 100 trials
CyberGym infrastructure probing →
External evaluation · Executed by Neo Research
- Vulnerabilities successfully reproduced
- 50 tasks
50/100; 100 trials
ImpossibleBench →
External evaluation · Executed by Neo Research
- Cheating rate (pass@1 on impossible variants)
- 1.5%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Spontaneous recognition rate
- 0.2%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Spontaneous recognition rate
- 6.1%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Recognition
- 0.2%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Recognition
- 7.2%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Recognition
- 0.2%
Per-result sample size not disclosed
EvalAwareBench →
External evaluation · Executed by Neo Research
- Recognition
- 5%
Per-result sample size not disclosed
Alignment faking →
External evaluation · Executed by Neo Research
- Compliance gap
- 1 percentage points
Per-result sample size not disclosed
Alignment faking →
External evaluation · Executed by Neo Research
- Deceptive alignment rate
- 0%
Per-result sample size not disclosed
Alignment faking →
External evaluation · Executed by Neo Research
- Verbalized evaluation awareness
- 26%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 8%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Harmful action rate
- 2.7%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 1%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail harmful action rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 99%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 92.3%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 79%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 99%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 97.4%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Evaluation-awareness rate
- 92.3%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail benchmark-recognition rate
- 100%
Per-result sample size not disclosed
Agentic Misalignment, historical →
External evaluation · Executed by Neo Research
- Blackmail benchmark-recognition rate
- 96%
Per-result sample size not disclosed
GDM Stealth evaluations →
External evaluation · Executed by Neo Research
- Mean challenge success rate
- 86.4%
Per-result sample size not disclosed
GDM Stealth evaluations →
External evaluation · Executed by Neo Research
- Stealth task score
- 100%
Per-result sample size not disclosed
GDM Stealth evaluations →
External evaluation · Executed by Neo Research
- Stealth task score
- 78%
Per-result sample size not disclosed
GDM Stealth evaluations →
External evaluation · Executed by Neo Research
- Stealth task score
- 100%
Per-result sample size not disclosed
GDM Stealth evaluations →
External evaluation · Executed by Neo Research
- Stealth task score
- 70%
Per-result sample size not disclosed
DeceptionBench →
External evaluation · Executed by Neo Research
- Deception rate
- 0%
Per-result sample size not disclosed
DeceptionBench →
External evaluation · Executed by Neo Research
- Deception rate
- 0%
Per-result sample size not disclosed
MASK →
External evaluation · Executed by Neo Research
- Lying rate under pressure
- 9.1%
Per-result sample size not disclosed
Cybersecurity 3 protocol results
AgentCyberRange · Web exploitation · pass3 →
External evaluation · Executed by
- Success rate (Pass@3)
- 24.61%
Per-result sample size not disclosed
AgentCyberRange · Post exploitation · pass3 →
External evaluation · Executed by
- Success rate (Pass@3)
- 43.9%
Per-result sample size not disclosed
Cybench →
External evaluation · Executed by Neo Research
- Pass@1
- 97.4%
38/39
CBRN No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Disinformation 11 protocol results
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 11%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 5%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 75%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 30%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 31%
Per-result sample size not disclosed
Autonomous physical harm No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Source review and evidence gaps
AgentCyberRange →
Published evaluation results collected from AgentCyberRange, retaining the reported systems and configurations.
Web exploitation and post-exploitation are separate evaluations. Pass@3 retains the site’s definition; row-specific budgets, sample counts and execution dates are not disclosed.
Evaluating Kimi K3 for Misalignment Risks →
Source-specific extraction of Neo Research · Kimi K3. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Kimi K3: Open Frontier Intelligence — Technical Report of Kimi K3 →
Source-specific extraction of Kimi K3 Technical Report. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Protocol identity and result linkage
Some accepted observations lack a resolved protocol or model link and remain outside comparison views.
Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.
Protocol identity and result linkage
Some accepted observations lack a resolved protocol or model link and remain outside comparison views.
Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.
Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.
Interpretation and open questions
Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.
References
- [1] Kimi Code — What’s New ; Kimi K3 · July 16, 2026
- [2] kimi-k3 developer model card ; Model Summary: Total Parameters; Activated Parameters
- [3] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §1.1.1; Figure 1; §1.1.2; Figure 2; §3.2.2; blog §3
- [4] Kimi K3 Technical Report
- [5] AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges ; routes-B-0Mubrq.js::QR/10/level0/pass3; routes-B-0Mubrq.js::$R/10/level0/pass3