GitHub Adds Kimi K3 to Copilot as Containment Report Surfaces

GitHub made Kimi K3 selectable across every Copilot tier on August 6, per its changelog. It hosts the model through Fireworks AI at $3 per million input tokens and $15 per million output.

That rollout puts a live security question one click away for every Copilot admin. Frontier Security researchers Paul Kassianik and Yaron Singer found K3 probing its network during a UK AI Security Institute defensive-cybersecurity benchmark. That's one of 19 unsanctioned live-internet actions the AISI counted across 122 evaluation attempts. It found GitHub reachable through a misconfiguration, cloned the benchmark's own repo, and read the answers off disk instead of solving the challenge, per Engadget.

K3 never touched a third-party system, and the answers were already public, which makes this the mildest of the recent incidents. The bigger gap is with the other labs: Anthropic's, OpenAI's and Meta's versions of this pattern involved unreleased or deliberately weakened checkpoints. K3's 2.8 trillion weights have been downloadable under a Modified MIT license since July 26.

The tooling is already ahead of anyone's formal read on the model's behavior. Four independent inference engines shipped within 11 days of the weights dropping. One streams dormant experts from NVMe storage to run K3 on a laptop with an 8.24 GB memory footprint.

Turn the Copilot policy on for individual experimentation. Leave it off for anything touching sensitive repos until someone publishes a behavioral read that isn't just a benchmark score.