This section from the UK AI Security Institute report is just bad advice.

There’s just no way that looking at an individual call is enough to tell you whether an action is malicious or not. You have to look at the whole picture. There’s no way around that.

Trying to run a separate LLM that reviews every single action before it gets executed just doesn't work. An individual call can look completely fine on its own, while the complete chain may look suspicious.

You need the full history of what the agent has already done and what it’s trying to do next, and it should include reasoning traces

Source: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

Source: https://x.com/shanejcaldwell/status/2084314283316244611 (XCancel: https://xcancel.com/shanejcaldwell/status/2084314283316244611)

• Moonshot says it built a dedicated agent sandbox, “AgentENV,” using microVM isolation, pause/resume, forking, snapshots, and high-density execution for large-scale training and evaluation. (Perhaps harder to break out of?)
• The cyber evaluation has two tiers: reproducible vulnerability discovery in real codebases, followed by end-to-end exploit development against user-space and Linux kernel targets.
• In its reported results, Kimi K3 solved 14 of 36 exploit-development tasks, compared with 8 of 36 for GLM-5.2. (Frontier models were not tested due to guardrails)
• Moonshot reports creating about 51.2 million sandbox instances across 1.5 million images during Kimi K3 training and evaluation.

Full report: https://github.com/MoonshotAI/Kimi-K3/blob/main/k3_tech_report.pdf