Kimi Desktop lanzó la puerta de enlace oculta de Moonshot para acceso fuera de cuota a Kimi, GPT y Codex dentro de su cliente público.
La versión 3.1.10 identifica el servicio exclusivo para oficinas como "KTH Gateway (Internal)", requiere un token Bearer personal y enruta el acceso fuera de cuota a Kimi, GPT y Codex a través de un pool upstream compartido.
By Ryan Merket · Published · Updated
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering, testing, data analysis.
Por qué importa
El panel oculto expone cómo Moonshot separa el tráfico de modelos de empleados de las cuotas de los clientes dentro de un cliente de escritorio con amplio acceso al sistema local.
Reporting record
Finding
Kimi Desktop 3.1.10 hides an internal, office/VPN-only KTH gateway behind five rapid clicks on its Version row, allowing personal-token import of off-membership-quota Kimi, GPT and Codex models from free-tokens.msh.team.
How we verified
Methods: reverse engineering, testing, data analysis.
Static analysis of Kimi Desktop 3.1.10 found a concealed BYOK feature absent from 3.1.5. Five rapid clicks on the Version row invoke the BYOK reveal handler and persist the setting in byok-availability.json. The interface identifies the service as “KTH Gateway (Internal),” defaults to https://free-tokens.msh.team/v1, requires a personal token and says access is limited to an office network or VPN.
The importer authenticates to /v1/models and /v1/models/api.json, accepts kimi-, gpt- and codex-prefixed models, and configures Kimi and OpenAI Responses providers. The application stores the complete token in byok-providers.json without application-layer encryption and also writes it into the daemon configuration. Runtime testing reproduced the hidden interface without entering a token or contacting the model endpoints.
We extracted the supplied 3.1.10 ASAR, decoded its obfuscated string tables and traced the renderer click handler through the preload IPC bridge to the main-process BYOK implementation. We compared the resulting code and strings against Kimi Desktop 3.1.5, which contained no BYOK, KTH or free-tokens.msh.team artifacts.
We then reproduced the interface on an installed Windows copy of Kimi Desktop 3.1.10 by opening Kimi Work Settings, scrolling to About and clicking the Version row five times quickly. The internal gateway panel appeared with the hard-coded endpoint and office/VPN disclosure. No token was supplied, no connection test was performed and no authenticated request was sent.
Tested versions:
- Kimi Desktop 3.1.10 (3.1.10+e0c4c9980)
- compared with Kimi Desktop 3.1.5 (3.1.5+c88420152)
Reproduction
RuntimeWire independently reproduced the core finding.
Install and launch Kimi Desktop 3.1.10. Open Kimi Work Settings. Scroll to the bottom of the settings pane and locate About. Click the Version row five times rapidly, keeping each interval under one second. Scroll upward to Model Sources. Confirm that “KTH Gateway (Internal)” appears with https://free-tokens.msh.team/v1 as the default Base URL. Do not enter a token or select “Test Connection & Import Models.”
Company response
RuntimeWire requested comment; the company had not responded by publication time.
Kimi Desktop 3.1.10 se lanzó con un panel de configuración oculto para la puerta de enlace multimodelo interna de Moonshot AI. Cinco clics rápidos en el número de versión de la aplicación revelan https://free-tokens.msh.team/v1, que el cliente identifica como "KTH Gateway (Internal)."…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.