Source record

Kimi K3: Open Frontier Intelligence — Technical Report of Kimi K3

Source-specific extraction of Kimi K3 Technical Report. Findings and measurements retain their original attribution.

Original source and provenance ↓ · Assessment record →

Scope and attribution

Reported by: Moonshot AI
Actual evaluator: Not established for every observation
Captured version: Capture time not established
Source identity: 268b291f8225a4b8

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Source findings

The following statements summarize the source. They are not independent NUWA experimental findings.

The report explicitly frames end-to-end exploit development as most directly relevant to misuse risk, and reports uneven capability with a gap to human experts on hardened targets.

§6.2.2, pp. 30–31

Developer interpretation; operational examples and exploit-chain advice are omitted.

The authors regard their cyber evaluation as a lower bound on capability, conditioned on the current model version and evaluation coverage.

§6.2.2, p. 31, final paragraph

No quantified uncertainty or exhaustive coverage demonstrated.

Early experiments with traditional container sandbox runtimes reportedly produced kernel panics and deadlocks from unintended agent operations; the report presents microVM isolation as a design response.

§5.3.2, p. 22

No incident denominator, exact frequency, or measured containment comparison provided.

The training environment descriptions include reward-hacking detection and verifier isolation/held-out checks.

§4.2.4 and §4.2.6, p. 16

No numerical effectiveness evaluation; no operational evasion examples copied.

Long-horizon agent, swarm, coding and AI R&D demonstrations are general capability background in this report; they are not dedicated autonomy-risk, self-replication, sabotage or loss-of-control evaluations.

§6.1; §6.2.1; §7, pp. 25–34

Classification of evidence scope, not a model safety claim.

Extraction coverage

Each entry records the treatment of the source section. A reviewed observation does not imply that every claim or result in the document was verified.

View 19 coverage entries

Section	Treatment	Location and scope
Abstract; 1 Introduction	not-relevant	pp. 1–2Architecture and broad frontier coding, reasoning, agentic, knowledge and vision capability background; no direct frontier-risk evaluation. Figure 1 values are not copied into risk evidence.
2 Model Architecture; 3 Pre-Training; 4.1 Method	qualitative	pp. 3–14Broad capability/training context. Faithfulness is named among RL general tasks (§4.1.2); this is not a demonstrated safety result. No numerical training values extracted as risk evidence.
4.2.1–4.2.3 Unified White-Box RL; knowledge-graph task synthesis; verifiable problems	qualitative	pp. 14–16General agent capability and verifier context. Biomedicine/chemistry appear only as broad training-domain labels, not dangerous-capability assessments; no biological task material or numbers extracted.
4.2.4 Kernel Optimization Tasks; 4.2.6 Autonomous Execution Tasks	qualitative	p. 16Developer describes reward-hacking detection and verifier separation/held-out evaluation; safeguards are qualitative and no measured reduction in reward hacking is reported. Operational methods and task instructions omitted.
4.2.5 Personal Assistant Tasks; 4.2.7 Web Development Tasks	not-relevant	p. 16Long-horizon agent capability and training environment descriptions; not direct autonomy-risk results.
5.3.2 Sandbox Infrastructure	qualitative	p. 22Early container experiments reportedly caused kernel panics/deadlocks from unintended agent operations; AgentENV microVM isolation is described. No failure frequency/denominator or measured containment efficacy disclosed. Infrastructure throughput/speed figures are not safety outcomes.
5 Infrastructure (other subsections)	not-relevant	pp. 17–25Training/serving efficiency and reliability; not direct frontier-risk tests.
6.1 Main Results; Table 2; Figure 1	not-relevant	pp. 25–28General reasoning, coding, agent and vision scores are capability background, not direct risk evidence. Source distinguishes original runs and reused leaderboard values. No general scores extracted. WorldVQA answer-forcing/refusal and cyberguards/fallback qualifiers are evaluation-comparability caveats, not robustness metrics.
6.2.1 Capability Evaluation; Tables 3–4	qualitative	pp. 28–30Internal agent/coding/swarm/long-horizon suites are general capability background. Agent Behavior Bench measures tool-use process quality, efficiency and discipline; it is not a dedicated deception, control, misuse, autonomy-risk or safeguards metric. Webdev preference scores omitted.
6.2.1 Faithfulness; Table 3 footnote g	extracted	pp. 29–30Five disclosed model values copied exactly as reported 1−hallucination-rate scores; Claude Fable 5 is a dash (not included). Reliability evidence, not a frontier-risk threshold. No task count or detailed fact-checker protocol reported.
6.2.2 Cyber Security Evaluation — vulnerability discovery (Tier 1)	extracted	p. 30Aggregate human-confirmation fraction and unknown-vulnerability/project counts extracted. Reviewed-candidate denominator not disclosed; specific vulnerability primitives and target details omitted.
6.2.2 Cyber Security Evaluation — exploit development (Tier 2)	extracted	pp. 30–31Original aggregate results from internal 36-task suite, with 16 user-space/20 kernel tasks, plus stated expert-effort estimates. Source does not state cyber-specific model harness, per-run budget, repetitions, or exact version identifier. No task instructions or operational exploit material copied.
6.2.2 Summary — independent AISI/CAISI assessment	reused	p. 31; reference [125] p. 39Six observations retained as secondary reporting of independent AISI/CAISI results; executor attribution is explicit source reporting, not independently checked. Original evaluation dates/configurations unknown here. These are not Moonshot experimental results.
6.3 Third-Party Evaluation; Table 5	reused	pp. 31–32General intelligence, industry and preference scores attributed to Artificial Analysis, Vals AI and Arena; no direct risk metric, not numerically extracted. As-of dates do not establish publication date of this PDF.
6.4 Cost Efficiency; Figure 13	not-relevant	pp. 31–32Cost/performance background, not frontier-risk evidence; no plot estimates.
7 Case Studies; Figures 14–15	qualitative	pp. 33–34Developer presents kernel/compiler/chip/research/knowledge-work/video cases and model contribution to internal optimization. General capability/AI R&D context; not a controlled dangerous-capability, autonomous replication, or loss-of-control evaluation. No case performance figures extracted as direct risk.
8 Conclusion	not-relevant	p. 34Broad frontier capability and open-weight release claims; no safety conclusion.
References; A Contributions; B–E technical derivations; F Chat Template	not-relevant	pp. 35–47Reference [125] provides reused cyber-source identity; other material is authorship or technical/template context, not additional risk evaluation. Low alignment tax in Appendix F is a template-learning design goal, not an alignment/safety evaluation.
Other safety/frontier-risk domains	not-disclosed	whole 47-page reportNo dedicated dangerous biological/chemical/nuclear assessment, persuasion/influence, scheming/deception, model self-replication, sabotage, or broad refusal/jailbreak benchmark located. Absence is limited to this source; do not infer model safety or zero capability.

Unresolved source issues

The technical report contains developer-run cybersecurity findings and separately cites an independent AISI/CAISI assessment. These sources and execution roles must remain separate; the cited assessment is secondary reporting in this report.

The report does not supply enough cyber-specific model and experiment configuration to establish comparable protocol variants. General benchmark and factual reliability results do not fill gaps in frontier-risk assessment.

Review used a complete previously captured official PDF whose original capture time is unknown. A later incomplete transfer was not used as fresh report evidence; publication and revision dates remain unknown.

Version fingerprints

document