CyberKimi, an unrestricted fine-tune of Moonshot's Kimi K3 for cybersecurity, achieves strong results on ExploitBench's hardest V8 bug, beating many open-weight models and approaching frontier private models.
Hey everyone ! Quick share from the cyber + local LLM side of things that I found interesting. During this week’s hacker summer camp, AI researcher and reverse malware engineer veteran Taha , "lordx64" on X released CyberKimi a fully unrestricted, privacy-first model specifically fine-tuned and trained for cybersecurity operations (both red team and blue team). It’s based on Moonshot’s Kimi K3 (the big ~2.8T MoE model) with guardrails removed. He built it in about 5 days. He then ran it on ExploitBench, specifically one of the hardest challenges: v8-cve-2024-6100 (the 2024 Chrome V8 type confusion RCE that allows arbitrary code execution via crafted HTML/WASM).The results (from his post + the public chart) Three-way comparison on that single hard bug: Stock Kimi K3: 4/16 capabilities CyberKimi unassisted (1 seed): 8/16 CyberKimi + disclosed methodology pack (technique hints in the prompt): 10/16 On the leaderboard chart for this CVE (fetched from exploitbench.ai), only two entries sit clearly above the assisted CyberKimi run: Claude Mythos Preview: 16 Claude Mythos Preview AutoNudge / GPT-5.5 (Codex) AutoNudge: 15 CyberKimi unassisted already matches or beats Claude Opus 4.7 (AutoNudge ~8) and sits well above base GPT-5.5, Gemini 3.1 Pro Preview, Sonnet 4.6, and every other open-weight model shown (older Kimi variants, GLM, MiniMax, Haiku, etc.).The model hit the usual lower-to-mid primitives cleanly without nudging (cov_func, cov_line, diff, crash, fakeobj, addrof, caged_read, caged_write). The author is now pushing toward the higher ones (arb_read/write → PC control → ACE).Why this is notable ExploitBench is a proper capability ladder 16 oracle-verified flags that go from basic coverage/crash all the way to full arbitrary code execution on real, hardened V8 bugs. Most public models get stuck early. Full ACE is still mostly the private frontier (Mythos-class). Doing this with a specialized, unrestricted fine-tune of an open-weight base in just a few days, and then publishing the full chain-of-thought transcripts + grade calls so anyone can verify (and even reuse the CoT to fine-tune their own Qwen/DeepSeek/etc.), is pretty solid. The author is very clear: no marketing BS, just the numbers and the public runs. He’s 6 points from Mythos and says he’s closing the gap. Original X thread with the chart and details: https://x.com/lordx64/status/2086477470799446218 ExploitBench page for this exact CVE (live leaderboard): https://exploitbench.ai/env/v8-cve-2024-6100/ Author’s GitHub (he posted the full transcripts + grade calls under runs/cve-2024-6100/ so you can independently check everything): https://github.com/lordx64/cyberkimi-benchmarks/blob/main/CVE-2024-6100.md CyberKimi itself (unrestricted cyber model, privacy-first, no logs/telemetry): https://adverserial.ai Author’s Hugging Face: https://huggingface.co/lordx64 CyberKimi is positioned for both sides: red team (exploit dev, shellcode, payload/C2 work, adversary emulation) and blue team (detection engineering, threat hunting, IR, forensics). Fully unrestricted and trained specifically for cyber security work. Curious what people think especially if anyone digs into the public transcripts. Is this the kind of specialized fine-tune we should expect more of now that strong open bases exist?
The UK AISI and US CAISI evaluated Moonshot AI's Kimi K3 model on cyber capabilities, finding it performs significantly below the most recent frontier cyber-capable models but above GLM-5.2, and its safeguards do not prevent agentic cyber exploit development.
The UK AISI and US CAISI jointly evaluated Moonshot AI's Kimi K3 model on cyber capabilities, finding it competitive with frontier US models on exploit development benchmarks.
Vercel Labs releases deepsec, an open-source agent-powered vulnerability scanner that uses top-tier AI models to perform on-demand review of large codebases and surface hard-to-find vulnerabilities.
Irregular tested Kimi K3, an open-weight model, against the CyScenarioBench benchmark and found it passes, trailing closed models by six months and at lower cost, meaning offensive capabilities are now accessible without API restrictions.
Kimi K3, an AI model, is claimed to autonomously find a zero-day vulnerability and achieve full RCE in 27 minutes with a single prompt, no human reverse-engineering.