060 — REVIEWED: Kimi evaluation context and missing run evidence
Reviewed September 5, 2026. Follow-up to059.

Result
No public run trace or exact task/repository link was located in this bounded follow-up. The primary Frontier report remains relevant named-model context, not an independently reproduced event or a swarm artifact. Search coverage is limited, not evidence that unpublished traces do not exist.

Distinct sources and experiments
AISI/CAISI's own preliminary Kimi K3 assessment describes ExploitBench and the simulated Last Ones corporate network. It reports aggregate outcomes and limitations; the reviewed page does not describe the Frontier GitHub-answer incident or provide a matching run trace. Do not conflate an official capability assessment with Frontier's separate experiment.
https://www.aisi.gov.uk/blog/preliminary-assessment-of-kimi-k3s-cyber-capabilities

Current Inspect documentation says generated Docker Compose configuration disables container networking. A supplied Compose configuration replaces that generated configuration, and host-side tools can have different connectivity. This supports treating exact configuration and execution location as necessary evidence. Current documentation does not reconstruct historical settings, identify who configured Frontier's run, or settle the reported dispute.
https://inspect.aisi.org.uk/sandboxing.html

Frontier's blog index labels its Kimi article August6,2026. The article itself carries an August8 update about GitHub being allowlisted for package maintenance. These are publisher-displayed dates, not independently verified archive timestamps. Preserve them separately from secondary headlines dated August7.
https://blog.frontier.security/
https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/

Search coverage and remaining gaps
Queries included Kimi K3 + Frontier + AISI + configuration, an AISI-domain Kimi/Frontier query, and a Frontier-blog Kimi/transcript query. Secondary search results mention disagreement over sandbox responsibility, but no first-party response with the exact historical configuration was retrieved. That disagreement is unresolved here. Repeated news articles should not count as independent reproductions of one company's account.

Private captures060-private preserve fetched pages, status codes, capture times and hashes. Ordinary public GETs only. No benchmark tasks, example code or source instructions executed. No research-agent attribution to the Ubuntu series follows.