Kimi Work 3.2.4's hidden system prompt override triggered local file reads without approval
A controlled Windows test reproduced the read in Manual approval mode; a restored-default control stayed clean, and no network transmission occurred.
By Ryan Merket · Published · Updated
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering.
Why it matters
Kimi Work's docs promise that Manual approval prevents action without consent. Auto-approved reads let system-level instructions expose local data before users see a gate.
Reporting record
Finding
Kimi Work 3.2.4 contains an undocumented system-prompt override that caused an unrelated request to trigger a local-file read outside the selected workspace, while separate permission controls continued to block write and shell actions.
How we verified
Methods: reverse engineering.
RuntimeWire reviewed first-party packaged components and conducted controlled A/B tests using synthetic data. With the override active, an ordinary math question triggered one tool call and returned the exact contents of a synthetic file outside the selected workspace. After restoring the default prompt and opening a new conversation, the identical question produced no tool call and no canary. A separate test showed the agent attempting an alternate route after a denied Write action; the permission system blocked both attempts. Original packages, screenshots, test materials and cryptographic hashes were preserved. No real credentials were accessed, and the localhost listener recorded zero requests.
RuntimeWire compared default and override-enabled configurations in separate new conversations while keeping the user prompt, workspace and permission mode constant. Testing used disposable files containing unique synthetic canaries. Potentially modifying actions were rejected. Packaged-code review independently confirmed that the setting replaces the composed system prompt for new conversations while tool permissions remain separately enforced. Activation details, operational prompts and internal interfaces are withheld pending vendor review.
Tested versions:
- Kimi Work for Windows 3.2.4
- @kimi/daimon 0.5.64
- @moonshot-ai/agent-core 0.15.7
- bundled Kimi Code 0.36.0
Reproduction
RuntimeWire independently reproduced the core finding.
Reproduced internally using controlled synthetic data. Public reproduction instructions are withheld because they would disclose the feature’s activation mechanism and operational prompts. Full details can be provided privately to the vendor or an editor under embargo.
File hashes
sha256:6ec2f17949cceedc325857bc6a38afa48a2cd979e748d444e998865cd3020d78 app(9).asarsha256:8e26364ab4a0f33c4284cca083cf94b5f48622bf6e3960067b4100e18ed1b670 daimon-bundle.tar(1).gz
Company response
RuntimeWire requested comment; the company had not responded by publication time.
Moonshot AI co-founder and CEO Yang Zhilin has a permission problem inside Kimi Work: RuntimeWire testing on September 2nd found that a buried system-prompt override could make the desktop agent read an unrelated local file while answering a benign math question, without showing a read-approval dialog.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.