Nathan Lambert and Florian Brand on Kimi K3.1, Cyber Risk and AI Agents

Nathan Lambert asks Florian Brand whether Kimi K3.1 Pro will live up to its exceptional benchmark scores. Brand says previous Kimi releases generally met expectations, but this launch feels different: it is more professional and has attracted criticism over its promotional campaign.

Lambert says a circulating screenshot allegedly instructed promoters not to disclose payment, but he has not seen independent corroboration. Both speakers criticize undisclosed promotion more broadly. Brand says model launches have become professionalized: inference frameworks and providers now prepare support for launch day.

Some developers keep exclusive access for a few weeks before releasing weights; Kimi K3.1 Pro is expected to follow that pattern. Lambert notes its high Artificial Analysis ranking but also much weaker scores on some longer-tail benchmarks, alongside mixed early user impressions.

Brand says benchmark time horizons may explain part of the divergence. Some evaluations are relatively short and goal-directed, while ProgramBench requires exploration over a longer task. He speculates that reinforcement-learning training may favor exploiting known paths more than discovering solutions.

Lambert argues that a very large, slower model needs to justify itself on ambiguous work; faster small models may be competitive for familiar coding tasks. He finds some frontier models better at interpreting fuzzy requests, while open models can be effective at sustained, cheaper work.

Brand adds that serving a roughly three-trillion-parameter model requires substantial hardware. Fitting a replica on a suitable node is awkward compared with smaller models that run on more readily available GPUs. This infrastructure cost can affect adoption independently of benchmark rank.

Lambert asks about Moonshot's stated aim not to push the absolute frontier of offensive cyber capability in its open-weight release. He asks whether reducing cyber material during mid-training might also affect unrelated long-horizon abilities.

Brand thinks the two can be separated and welcomes a release that supports broad defensive access without advancing offensive capability. He says penetrating an entire organization requires persistence across many stages, while finding and fixing bugs need not require the same long-horizon capability.

Brand argues that removing some attack-oriented tasks from training can be reasonable and gives Moonshot a way to explain its risk posture. He believes open models receive particularly heavy scrutiny and disputes predictions that one release would immediately cause catastrophe.

Lambert emphasizes that neither speaker is a cybersecurity expert. Security researchers he follows often examine long-running ecosystem trends in vulnerability discovery and exploitation, whereas AI discussions focus on the open-versus-closed model debate. He is trying to understand how the two perspectives fit together.

Lambert revisits public discussion of frontier cyber models and says he wants to check the original communications rather than attribute every alarming claim to a lab. He remembers repeated dire warnings, but acknowledges that large numbers of vulnerabilities are now being found.

Lambert says reported cyber damage and ransomware losses are useful measures, but the effect of newly discovered vulnerabilities on real harm remains uncertain. He sees some increase in visible incidents and worries that a surge in damages attributable to AI would represent a difficult new world.

He considers an argument that the supply of capable, willing attackers may itself be a bottleneck. Nation-state actors could use AI for infiltration, while it is unclear how many actors would use it for conspicuous physical damage. He finds it unsettling that the answer may become clearer only as events unfold.

Brand describes a serious PHP vulnerability and a coordinated effort by security researchers and the PHP community to patch it. Because PHP supports many websites, including WordPress installations, organizations had strong reasons to patch quickly and some took sites offline while doing so.

Brand says some observers expected immediate mass exploitation, but reports available to him did not show that outcome yet. He expects many defenders to respond quickly and notes that nation-state actors have resources and capabilities different from individual attackers. His tentative view is that existing security dynamics are accelerating.

Brand also notes that small organizations sometimes run old, unsupported PHP versions and may already be exposed to older flaws. He cites a preliminary account of a LiteLLM compromise involving an exposed API key as an example of a weakness that reportedly remained available for months before exploitation.

Lambert does not think defense is clearly dominant, but he questions whether offensive model capability alone is the main bottleneck. More capable tools do not automatically multiply an attacker's output. He is concerned that coding agents also increase the volume of software, creating more interactions and potential vulnerabilities.

For a period of years, Lambert expects defenders may face both an existing backlog and rapidly growing quantities of new code. He finds the open-versus-closed framing insufficient on its own and wants better discussion between the AI and cybersecurity communities about timing and causation.

Lambert revisits his earlier view that an open-weight frontier cyber model could have been released sooner. He says causality is hard to establish and he should have studied existing vulnerability trends more closely. He wants stronger evidence about how organizations actually use open models for defense.

Lambert is skeptical of services marketing models with safeguards removed over an API, particularly when privacy is a reason to run open weights locally. Brand says it remains unclear how much removing safeguards helps compared with the marketing value of the claim.

Brand argues that access to closed-model security programs has sometimes been too limited, leaving researchers to use less capable open models. He describes OpenAI's defensive access process as relatively accessible and says he has heard that Anthropic is broadening access. He sees wider responsible access as important for addressing the software backlog.

Lambert believes trusted-access programs deserve credit for helping researchers discover and disclose vulnerabilities. He says open-model usage is harder to observe and political reactions to a major incident could be severe. Looking back, he would put more emphasis on pre-existing security trends and the wider ecosystem.

Brand says closed providers can update safeguards quickly and cites a reported response that blocks easy requests for the PHP exploit. Lambert sees a gray area: safeguards may stop casual misuse while sometimes obstructing legitimate researchers, and reports still show determined actors finding ways around protections.

Lambert asks about reports that Anthropic will not hire junior employees. Brand thinks other employers can benefit from hiring ambitious early-career researchers, recalling how young researchers helped Chinese labs catch up. Both are offering reactions to the reported position, not a complete account of the company's hiring policy.

Lambert argues that preparing society for powerful AI should include training people and giving them meaningful work. He worries that an excessive focus on short timelines can discourage mentorship and damage a lab's relationship with society, especially if employment slows.

Brand says he has not seen mass displacement even in software and observes that teams are using coding agents to do more. He expects firms willing to hire juniors to find strong candidates. Both speakers say the pace at which AI diffuses into work remains uncertain.

Looking ahead, Brand expects more vulnerability disclosures and model releases from both US and Chinese developers. Lambert asks how those trends intersect with new consumer agents, leading Brand to describe his experience with Muse after moving to the United States.

Brand says he chose Muse partly because he did not want to maintain and secure his own agent infrastructure, especially for transactions. He also tried Dots. Although Muse is not the most capable frontier model, he finds it useful for proactive assistance during a move involving accounts, forms and appointments.

He says Muse reminded him what documents he needed and where to find them. By contrast, some suggestions from the other assistant felt stale. The usefulness, in his experience, depends on whether proactive messages reflect the user's actual circumstances rather than merely repeating old activity.

Brand describes asking the agent to assemble a shopping cart for an empty apartment. He reviews the purchase and uses a one-time payment credential. The process can be slow, websites may block automated access, and a browser crash can force the agent to redo work; asynchronous tasks make those delays easier to tolerate.

Lambert asks how much context is necessary. Brand says he imported a memory export and connected email after discovering that direct iCloud integration was unavailable. As the agent receives purchase confirmations and appointment messages, it can provide more relevant assistance, though he notes the permission prompts around sensitive sites.

Lambert wonders about asking an agent to call a dentist. Brand says he takes over whenever the task involves a real person because he values genuine human interaction, while he is comfortable delegating forms and interactions with automated systems.

Lambert describes using an AI-writing detection service as one signal for handling email and wonders how people will establish a front door for messages from agents. He is unsure whether he personally needs an agent for ordinary activities, but sees value in delegating frustrating administrative tasks.

Brand says moving to a new country made the assistant unusually helpful: he could ask it for defaults and check unfamiliar information. Lambert mentions a domain transfer requiring customer service as a task he might try delegating. They close by hoping the audience stays secure and continues reporting vulnerabilities.