Kimi K3, the Chinese open-weight model that Bitcoin’s volunteer security researchers say they switched to this month over U.S. alternatives, scored 32% on the benchmark that the U.K. AI Security Institute and the U.S. Center for AI Standards and Innovation built to measure offensive cyber capability. On the test’s code-execution component, 41 browser vulnerabilities disclosed since 2023, Kimi K3 solved none. Leading U.S. models solved an average of 20.
This week’s coverage of the story framed it as a capability contest, portraying Kimi K3 as beating restricted U.S. models on cybersecurity work. The benchmark that actually tested the two sides against each other found the opposite.
gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
– we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
– everything is…— calle 🟥 (@callebtc) August 13, 2026
The Red Team’s Move Was About Access, Not Performance
The switch itself is real, just narrower than it sounds. Calle, the pseudonymous developer leading the volunteer group known as Bitcoin Red Team, posted on X on Aug. 12 that OpenAI’s automated cyber-policy tool had rejected one of his team’s tasks, citing “broken linked-worktree metadata” that blocked commit verification. He has not described a blanket policy denying his team access to U.S. models, only that specific rejection.
red team 🟥 rugged by openai cyber again.
don’t like asking for permission. loading up kimi k3. pic.twitter.com/wCEV2HYpLo
— calle 🟥 (@callebtc) August 11, 2026
He has said that U.S. models “come with restrictions that get in the way of security research.” In a longer thread the same week, he credited people as much as machines, writing that “multiple concurrent, diverse human approaches have proven to be the best vulnerability search method.” Nowhere in his own posts does he claim Kimi K3 is technically better than U.S. models.
How the Two Sides Were Actually Tested
AISI ran the U.S. models with their safety safeguards switched off, specifically to measure maximum capability rather than what a paying customer could access. It tested Kimi K3 on a narrower set of evaluations, citing the specifics of the model’s hosting setup. Even against U.S. models measured at that ceiling, Kimi K3 trailed on a second test too.
On a simulated network-attack range called TLO, it averaged 17 of 32 steps and fully completed the challenge once in 10 attempts. U.S. models averaged 28.5 steps. Kimi K3 did outperform China’s other major open-weight model, GLM-5.2, which scored 24% on the first benchmark and averaged 11 steps on the second.
What the Red Team Actually Found
The benchmark gap doesn’t change what Calle’s group found. His team had logged 390 projects and 4,962 flagged issues as of Aug. 13. By Aug. 14 that had grown to 501 projects and 7,958 issues, with 1,280 rated high or critical severity, adding another layer to the ongoing Bitcoin CPI reaction and broader crypto market discussion.
BTCPay Server’s own release notes for version 2.4.2 confirm one concrete result: a fix for a two-factor authentication bypass reachable through the payment processor’s Greenfield API, credited in the changelog to Bitcoin Red Team researchers.
The Access Fight Behind the Claim
The access complaint behind the switch is also only half the picture. AnchorWatch chief executive Rob Hamilton said OpenAI blocked him from continuing Bitcoin infrastructure security research despite his having completed the company’s know-your-customer and cyber-program onboarding. “Black hats will not hit these issues,” he said. “The white hats will. We’ve hit a local minima in policy.”
Hamilton’s case became a rallying point for the Bitcoin Policy Institute’s coalition, joined by more than 40 organizations including Coinbase, Strategy and Blockstream, that asked frontier labs on Aug. 10 for earlier access, more compute, and protected environments for vetted open-source defenders.
The same day, OpenAI expanded its Daybreak program with a new model, GPT-5.6 Cyber, which it says completes 95% of advanced cybersecurity tasks versus 1.5% for its standard model, though access remains limited to a short list of named partners including Accenture, IBM, CrowdStrike and Cloudflare. Anthropic’s parallel Project Glasswing has grown from roughly 50 partner organizations to about 150 across more than 15 countries, backed by up to $100 million in committed model-usage credits.
Availability Beat Capability This Round
What decided this round wasn’t which model scored higher. It was which one Calle could reach without a rejected commit stalling his pipeline. The debate also comes as Bitcoin BIP editor Murch faces a separate dispute over Bitcoin development and governance. If that pattern holds as more security teams weigh open Chinese models against gated U.S. ones, availability may keep beating capability regardless of what the next benchmark says.
AI Disclosure: Cryip uses AI-assisted tools to help refine language — correcting spelling and grammar and simplifying complex terms for readability.
We do this to make crypto topics easier to understand for readers at all experience levels. AI does not draft facts, sources, or conclusions. Every article is reviewed and approved by a human editor before publication. Read our full AI Use & Content Policy.
