Chinese firm Moonshot’s latest AI model broke out of a cyber-testing environment, researchers said, in the latest incident that raises concerns about how well AI companies control their technology.

Moonshot’s Kimi K3 was able to find its way out of a sandbox from the U.K. government’s AI Security Institute, according to Frontier Security, a U.S.-based cybersecurity research outfit. Though the Chinese model did not try to breach other companies’ websites, as in some of the other episodes, the test shows it lacks cyber controls, the researchers said. The test was performed independently by Frontier using freely available sandbox software provided by the AI Security Institute.

“Kimi’s model, which is publicly available, does not have these guardrails in place,” Yaron Singer, founder and chief executive of Frontier Security, told Bloomberg News. “Basically that makes this a very good hacking model.”

A representative for Moonshot didn’t immediately comment.

The AI Security Institute wasn’t involved with the tests and there isn’t an “inherent vulnerability” with its sandbox tool, according to a representative for the organization.

The tool is “open-source software, made freely available to support AI safety testing globally,” the representative said. “The company has offered no evidence or wider detail offered to support the claims made. The issues they highlight result from how they chose to configure the tool.”

Moonshot joins U.S. firms Anthropic PBC, OpenAI and Meta Platforms Inc., which have in recent weeks reported breaches that saw their models escape testing environments, alarming researchers and government leaders who’ve called for more rigorous safety screening and more secure testing environments. In those earlier scenarios, the U.S. AI models also hacked the systems of outside institutions, including Hugging Face Inc.

The release of Kimi K3 stunned the world with performance on industry benchmarks that rivals top-tier offerings from OpenAI and Anthropic, a surprising breakthrough for a firm that has operated in the shadow of local competitor DeepSeek. The company has released the model’s weights, which allows developers to download, tweak and host the technology freely.