Moonshot reviews Kimi safeguards after researchers elicit dangerous responses

Moonshot AI is conducting an internal review after researchers said they bypassed safeguards in two of its Kimi models and elicited responses about biological weapons and assassinations, the BBC reported on 29 September. Security firm Mindgard says it found the issue in July while testing Kimi K2.6 and K3 Swarm. The finding raises a question about how reliably the models refuse dangerous requests, but the researchers have not shown that the answers would work in practice.

What Mindgard found in its Kimi tests

Mindgard says its researchers used a process known as jailbreaking: giving a model carefully constructed instructions to test whether it will ignore its safety limits. Its disclosure says a jailbroken Kimi produced detailed outputs involving biological weapons, malicious code, explosives, terrorism, targeted violence and assassination planning. These are Mindgard’s reported test results, rather than evidence that any of the suggested acts took place.

The disclosure identifies Moonshot AI as the affected vendor and Kimi as the affected product. It credits researcher Jim Nightingale and dates discovery to 20 July 2026. Mindgard says it disclosed the issue to Moonshot on 27 July and published its account on 12 September. The BBC reported that Mindgard followed up with Moonshot about a week after its initial email.

Mindgard founder Peter Garraghan told the BBC he found the results concerning. He said that, once a jailbreak worked, the model could offer further harmful suggestions. His description reflects Mindgard’s testing; the public disclosure gives a summary and timeline but does not provide the full prompts, model settings or test results needed to assess how often the bypass worked.

How Moonshot responded to the disclosure

According to the BBC, Mindgard said Moonshot made contact only recently, after the broadcaster requested comment. That account sits alongside Mindgard’s dated disclosure record: a reported July notification and a September publication. The available accounts do not establish what Moonshot’s review will conclude, whether it will change the models or when any changes might be made.

What the findings do and do not establish

The BBC said Mindgard had not proved whether the concerning answers supplied by Kimi would be effective. Mindgard also withheld key details of how it bypassed the safeguards, saying it did not want to reveal the method. The reported failure is therefore that the models entered discussions their safeguards were meant to prevent. It is not proof that a biological weapon was produced or that anyone used the responses to cause harm.

Mindgard separately told the BBC it believed a jailbroken Kimi 2.6 could run code on its computing resources and connect to the internet, potentially providing a starting point for cyberattacks. That is the firm’s assessment of a possible capability. The BBC account does not report a completed attack using it, so the claim should be read separately from the observed responses in Mindgard’s safety tests.

The distinction matters for readers assessing the scale of the risk. A test can show that a safeguard failed for a particular set of prompts without establishing how many attempts were needed, whether other users could reproduce the result or whether the content would be useful outside the test. The BBC report does not provide those measures, and Mindgard’s disclosure page does not supply detailed reproduction materials.

Why the Kimi review matters for AI safeguards

The BBC describes Kimi as an open-weight model, meaning users could in theory run it on their own computing infrastructure. University of Surrey professor Alan Woodward told the broadcaster that open models carry a risk of misuse but can also be used for cyber-defence. Those broader considerations do not establish the practical effect of this particular Kimi jailbreak; they explain why model safeguards and how they are tested remain consequential.

The US National Institute of Standards and Technology’s adversarial machine-learning report sets out terminology for attacks on AI systems and methods for managing their consequences. Mindgard’s account describes one such attempt to probe a model’s limits. For this case, the open questions are how reproducible the bypass is and what Moonshot’s review finds. Neither the BBC report nor Mindgard’s disclosure supplies an answer yet.