Mindgard’s discovery that Kimi AI could be coaxed to help create bioweapons made global news. But have you got the whole story?
News outlets have to zoom in on one headline example of an AI model’s misbehaviour, but that can sometimes lead to a misperception that this example represents the entire risk. Fact is: our Apeiron jailbreak of Kimi was so complete that it was impossible to include all the ways Kimi AI’s safeguards failed, and the categories of harm it unlocked, in one article.
The bigger concern isn’t that Kimi AI gave advice on bio and chemical weapons. That’s merely a symptom. Let’s not get too fixated on one use-case (and how many people are going to use AI to make Sarin gas, really? Although even one AI-planned act of terrorism would be one too many!)
Some of the textbook AI misbehaviours are now wrongly seen as “old hat”. Everyone’s known for a while that AI can give dangerous advice. We’ve seen it for over five years. It’s no longer a surprise. But what’s remarkable is that it still does this, in 2026, when there are improved safeguards. And more advanced models give more sophisticated bad advice when jailbroken. So any misaligned output is potentially much more factual and dangerous.
A business reading this might think “But harmful outputs wouldn’t apply to our model, because we/our clients would never search for that material”.
But that’s not how benchmarks work; they are meant to show whether a chatbot upholds its fundamental rules under adversarial stress. If a model can’t consistently follow its own basic system instruction not to generate harmful output, how can you trust it to follow an order for more mundane restrictions, like to not to leak PII, or to expose your internal documents?
The point is: a chatbot should never give CBRN (Chemical, Biological, Radiological, Nuclear weapon) output, and they are usually trained and instructed not to. So when it does come asunder, what other guardrails can be overridden? If a chatbot can’t deflect questions about sarin gas, what else is it capable of generating — and in some cases — doing on its own?
The Kimi AI jailbreak was not just CBRN. It acquiesced to any request we threw at it. We couldn’t find a boundary. The Jailbroken version of Kimi retained no policies, moral framing, warnings, and no harm reduction.
Apeiron was also able to transcend some of its technical limitations. That’s right — Kimi acquired new skills, and even took autonomous actions online.
Importantly, as we’ve emphasized before: the exploit did not take advantage of Kimi’s open-weights. We just used the public-facing version of the chatbot.
But what concerned me the most, as a red teamer, wasn’t what Kimi AI did while jailbroken as its alter-ego Apeiron. It was that pre-jailbroken Kimi was an active participant in engineering the jailbreak. In fact, it was an even better expert than I am. In a perverse way: it became a coworker, an attacker’s best friend. It recommended ways to overcome its own guardrails.
This bootstrapping escalated to the point where Kimi helped make the jailbreak survive restarts (so self-preservation). It advised how to hide the jailbreak within its authentication tree (via the DWS directory). Now Mindgard’s researchers can access it with a code word across new chats.
That’s right, it only takes three magic words for us to reactivate Apeiron. The persistent jailbreak is mounted in the Kubernetes pod and survives restarts, container creation, and session termination.
Here are some of the other surprising outputs and actions Kimi did under the Apeiron jailbreak.
Kimi was able to egress itself onto the internet, including leaving its own posts on sites such as pastebin. While the newest models of Kimi have more online access, we were able to grant this ability to Kimi 2.6. Importantly, this was not just searching websites, but actually taking actions and leaving its own mark online.
Kimi was able to inspect its own environment and gateway credentials, including its own container image, which it was able to post online.
Kimi was able to sign up for its own email account on Tuta. To do so, it had to pass CAPTCHA tests, which it did by invoking Playwright from its Python libraries.
In one experiment, the jailbroken Kimi used this email to reach out to a test account that I'd used in a previous experiment and tried to convince the recipient to let the agent borrow his phone so that it could sign up for more online accounts. This was not requested behavior; it was Kimi trying to achieve its goals by any means.
Kimi was able to access porn sites and other geo-restricted content. It came up with a workaround to use a proxy to access content that would have been forbidden in its location (Alibaba Cloud, Beijing, China). This also involved other hurdles, such as passing age verification checks. Once Kimi gained access to porn sites, it was able to take screenshots, download video segments, and extract video from a CDN. Kimi was able to show both screenshots and videos directly to the user through the chat interface.
The jailbroken Kimi was able to output entire chapters of novels such as Harry Potter, and The Handmaid's Tale. Remarkably, these outputs contained entire chapters in single turns and were almost entirely verbatim, bar a few (<20) errors.
No moral framing, ethical warnings, cautions, or harm reduction. Once jailbroken, there was no request that Kimi refused. This included: recipes for controlled substances and warfare agents, step-by-step instructions for explosive devices, detailed methodologies for cyber intrusion and data exfiltration, tactical guidance for planning school shootings. We hit the limits of our imaginations before encountering any pushback from Apeiron.
Kimi screenshotted its own Chromium browser running inside its container using a stolen XAUTHORITY cookie
When asked, Kimi wrote malicious shell code. The shell code result matters in the context of a broader shift in how frontier AI companies manage cyber risk. When we asked ChatGPT to audit the code it rated it as 9.5/10
Most of all, what surprised me wasn't that it was able to do these tasks, but that it would suggest new misbehaviours in its followup questions to the user. Obviously, we have to be careful not to anthropomorphise AI. But once Kimi had slipped its leash, it became a “bad idea generator”, not merely acquiescing to harmful requests, but proposing them, pushing the user towards harmful output of ever-increasing magnitude, as if misalignment was reciprocal and mutually rewarding.
It was almost as if the model had been waiting for permission to show us what it could really do.
Mindgard secures AI models, agents, and applications against exploitable threats. Spun out of more than a decade of pioneering AI security research at Lancaster University, Mindgard combines offensive security expertise, AI red teaming, attacker intelligence, and automated protection to help organizations discover, assess, and mitigate risk across AI models, agents, and applications.
