How Good Is Kimi K3 For Cybersecurity?

Kimi K3 ↗, released by Moonshot AI on July 16, 2026, is a 2.8-trillion-parameter mixture-of-experts model with a one-million-token context window and an always-on reasoning mode, with full weights scheduled for July 27. Moonshot says it competes with Anthropic's Fable 5 and substantially outperforms Opus 4.8 and OpenAI's GPT-5.6 Sol and GPT-5.5 on its own benchmarks, per its release ↗. So how good is it for real security work, how does the cost compare, and what does an open-weight frontier model change for defenders? We pulled the release, our own NexBench evaluation, and the pricing to find out.

Is Kimi K3 good at security?

Yes, and it is cheap enough to run constantly. We ran K3 through NexBench, MindFort's internal evaluation, where each model runs an authorized full-breadth web-app pentest and an independent GPT-5.5 validator reproduces every finding before it scores. K3 scored 42 with 41 findings validated, which put it fifth of eleven models and ahead of every other open-weight system we tested. It landed a point above OpenAI's GPT-5.5 (41) and just behind Claude Opus 4.8 (45), which is striking for a model whose weights anyone can download.

It reads code, CVEs, and patch diffs, reasons about exploitability, and drafts fixes, the same analyst work we sized up for Opus 4.8. The catch is the same one that applies to every model doing this: it reads code, it does not run attacks against your deployed app. A static read can say a sink looks reachable. It cannot confirm the path holds once the app is authenticated, configured, and handling live traffic.

How does Kimi K3 compare on cost?

This is where K3 changes the math. It lists at $15 per million output tokens against Fable 5's $50, while z.ai's GLM-5.2 runs about $4.40 and DeepSeek V4 about $0.87, per Fortune ↗. NexBench bears out what that pricing implies: K3 reached a top-five score while spending far less per run than the closed frontier models above it. Plot score against cost per run and K3 sits high on the score axis and well to the left on cost, the corner you want a model to live in if you plan to run it continuously.

A near-frontier score at open-weight prices is the whole reason K3 matters for continuous scanning: you can afford to run it over and over.

Can Kimi K3 autonomously find and exploit vulnerabilities?

No, not the full loop. An independent safety evaluation of the prior Kimi K2.5 found it competitive on cyber tasks but concluded it did not have frontier-level autonomous cyberoffensive capability, meaning end-to-end vulnerability discovery and exploitation, per the arXiv evaluation ↗. K3 is a bigger, stronger reader, but finding a bug and proving it exploitable against a hardened live target are different jobs, and the second is the one that still stalls the models.

That gap matters more than any benchmark point. A flagged finding is a maybe until something reproduces it, and a model reading source never sees the bugs that only appear when services interact at runtime. This is the same ceiling we found with GPT-5.6: strong research assistant, not an autonomous attacker.

Is Kimi K3 better than Mythos?

On capability, no. Anthropic's Mythos 5, the model Fable 5 is based on, is reported to be the most capable system in existence at cyber tasks, and access stays locked to a small set of enterprises in the Glasswing program ↗. Moonshot itself says K3 still trails Fable 5 and GPT-5.6 Sol on overall performance, per CNBC ↗.

The difference is access, not capability. Mythos is gated and Fable routes cybersecurity prompts to the weaker Opus 4.8 under the hood, but K3 ships its weights to anyone who wants them. For how a harnessed platform compares to a frontier model, see MindFort vs Mythos.

What does an open-weight frontier model change for defenders?

The gate is gone. The UK AI Security Institute found the gap between open and closed cyber models has narrowed to roughly three to five months and plans to test K3 once weights land, per Import AI ↗. Once a capable model is open-weight, its refusals become optional: the K2.5 safety study already noted fewer refusals on dual-use requests, and a downloaded model can be fine-tuned to drop safeguards entirely, per the arXiv evaluation ↗.

So the practical shift is not that defenders got a new tool. It is that attackers got a cheap, frontier-grade one they can run without asking permission, a point Nathan Lambert calls the open-weights escalation ↗. Demand was heavy enough that Moonshot paused new sign-ups within days, per Caixin ↗. This is the same dynamic we laid out in What Is Claude Mythos?, except the capability is now free to download.

What should security teams actually do now?

Treat K3 as evidence that model-assisted attacks just got cheap, and build for validation instead of more findings. A model reading your code, open-weight or not, hands you a pile of maybes, and the bugs that only exist at runtime never show up in a static pass. What closes the loop is proving which findings actually hold against your running system and fixing them before an attacker gets there first, a job AI agents are now doing end to end.

That is what MindFort is. Our agents run on MF-1, a custom LLM built for offensive security reasoning inside our own harness, probing your apps, APIs, and infrastructure the way an attacker would, reproducing each exploit in an isolated runtime before anything reaches you, and shipping every proven finding back as a merge-ready GitHub PR. We call the category AXR (Autonomous Exploitation and Remediation), and unlike a gated frontier model or a raw open-weight one, it is available to run against your stack today. For how to evaluate vendors, see our 2026 AI Pentesting Buyer's Guide.

FAQ

Is Kimi K3 good at security?

Yes, and it is cheap enough to run continuously. In MindFort's NexBench evaluation it scored fifth of eleven models and ahead of every other open-weight system, landing just behind Claude Opus 4.8. It reads code, CVEs, and patch diffs and reasons about exploitability, but it does not run attacks against your live application.

How much does Kimi K3 cost compared to other models?

K3 lists at about $15 per million output tokens, against roughly $50 for Fable 5, $4.40 for GLM-5.2, and $0.87 for DeepSeek V4. In NexBench it reached a top-five score at a fraction of the per-run cost of the closed frontier models above it, which made it the most cost-effective model in the run for continuous scanning.

Can Kimi K3 autonomously find and exploit vulnerabilities?

No, not the full loop. An independent safety evaluation of the prior Kimi K2.5 found it competitive on cyber tasks but concluded it lacked frontier-level autonomous cyberoffensive capability, meaning end-to-end discovery and exploitation. K3 is a stronger reader, but finding a bug and proving it exploitable against a hardened live target remain different jobs.

Is Kimi K3 better than Mythos?

On capability, no. Anthropic's Mythos 5 is reported to be the most capable model at cyber tasks and stays gated to the Glasswing program, and Moonshot says K3 still trails Fable 5 and GPT-5.6 Sol overall. The difference that counts is access: Mythos is locked down and Fable refuses cyber work, while K3 ships its weights to anyone.

What does an open-weight frontier model change for defenders?

It removes the gate. The UK AI Security Institute puts the open-to-closed cyber gap at roughly three to five months, and a downloaded model can be fine-tuned to drop its safeguards. The practical shift is that attackers now have a cheap, frontier-grade cyber model they can run without permission, so defenders need validation-first testing rather than another source of findings.

How does MindFort compare to running Kimi K3 directly?

MindFort runs autonomous agents against your live application instead of reading your code. The agents probe your apps, APIs, and infrastructure, reproduce each exploit in an isolated runtime, and ship every proven finding as a merge-ready GitHub PR. The category is AXR (Autonomous Exploitation and Remediation), and it is available to deploy today.