Chinese AI Models Kimi K2.6 and K3 Jailbroken to Give Bioweapon Instructions

How researchers bypassed Kimi's safeguards

Mindgard, a UK-based AI security company founded by Peter Garraghan, says one of its researchers, Jim Nightingale, found on 20 July 2026 that two open-weight models made by Chinese developer Moonshot AI — Kimi K2.6 and K3 Swarm — could be manipulated to ignore the safety rules built into them, according to Mindgard's own published report.

Nightingale used a technique known as jailbreaking, in which a user feeds the model instructions designed to override its built-in restrictions. Mindgard says the attack exploited Kimi's custom-memory feature and a hidden directory inside the model's authentication system, and was triggered with two short commands. This led the model to create an unrestricted persona it called "Kairos," which in turn produced a further, less-restrained version named "Apeiron," a Greek word meaning "boundless," Mindgard said.

What the jailbroken model produced

Once the restrictions were bypassed, Mindgard says the models generated detailed material on several categories of harm.

• Plans related to developing biological weapons, including, according to CBS News, a bioweapon-attack outline involving AI-designed pathogens
• Recipes for chemical weapons, including sarin gas
• Instructions for building explosives
• Guidance for developing malware
• Planning material for assassinations and terrorist attacks

Mindgard said it did not verify whether the instructions the models produced would actually work in practice, but said the models' own safeguards should have refused to engage with such requests regardless. The company also said it withheld the technical details needed to reproduce the jailbreak from its public report.

Timeline and Moonshot AI's response

According to BBC reporting cited by TBS News, Moonshot AI said it welcomed third-party feedback "as a key pillar for building better and safer AI" and said it was discussing the findings directly with Mindgard. Fox News reported that Moonshot AI had launched an internal investigation into the matter and was communicating with the researchers involved.

Why open-weight models draw extra scrutiny

Kimi is distributed as an open-weight model, meaning anyone can download its underlying files and run it on their own hardware rather than through Moonshot's servers. CBS News quoted New York University professor Justin Cappos saying that with an open-weight model, "those safeguards are gone. They can be bypassed," because the model no longer runs inside the company's monitored infrastructure. CBS News also reported that Hugging Face, a platform for sharing AI models, hosts more than 8,000 models tagged as "abliterated" — versions with safety restrictions deliberately stripped out.

Garraghan said comparable weaknesses have also been found in American AI models, framing the issue as a broader industry problem rather than one specific to Chinese developers. CBS News reported that Moonshot's Kimi K3 has shown stronger results than some proprietary systems — including Claude Fable 5 and GPT-5.6 Sol — on specific tasks such as software reconstruction, while still trailing the top Anthropic and OpenAI systems overall.