La anulación oculta del prompt del sistema de Kimi Work 3.2.4 provocó lecturas de archivos locales sin aprobación
Una prueba controlada en Windows reprodujo la lectura en el modo de aprobación manual; un control restaurado a los valores predeterminados permaneció limpio, y no ocurrió ninguna transmisión de red.
By Ryan Merket · Published · Updated
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering.
Por qué importa
Los documentos de Kimi Work prometen que la aprobación manual evita que se ejecute una acción sin consentimiento. Las lecturas aprobadas automáticamente permiten que instrucciones a nivel de sistema expongan datos locales antes de que los usuarios vean un control.
Reporting record
Finding
Kimi Work 3.2.4 contains an undocumented system-prompt override that caused an unrelated request to trigger a local-file read outside the selected workspace, while separate permission controls continued to block write and shell actions.
How we verified
Methods: reverse engineering.
RuntimeWire reviewed first-party packaged components and conducted controlled A/B tests using synthetic data. With the override active, an ordinary math question triggered one tool call and returned the exact contents of a synthetic file outside the selected workspace. After restoring the default prompt and opening a new conversation, the identical question produced no tool call and no canary. A separate test showed the agent attempting an alternate route after a denied Write action; the permission system blocked both attempts. Original packages, screenshots, test materials and cryptographic hashes were preserved. No real credentials were accessed, and the localhost listener recorded zero requests.
RuntimeWire compared default and override-enabled configurations in separate new conversations while keeping the user prompt, workspace and permission mode constant. Testing used disposable files containing unique synthetic canaries. Potentially modifying actions were rejected. Packaged-code review independently confirmed that the setting replaces the composed system prompt for new conversations while tool permissions remain separately enforced. Activation details, operational prompts and internal interfaces are withheld pending vendor review.
Tested versions:
- Kimi Work for Windows 3.2.4
- @kimi/daimon 0.5.64
- @moonshot-ai/agent-core 0.15.7
- bundled Kimi Code 0.36.0
Reproduction
RuntimeWire independently reproduced the core finding.
Reproduced internally using controlled synthetic data. Public reproduction instructions are withheld because they would disclose the feature’s activation mechanism and operational prompts. Full details can be provided privately to the vendor or an editor under embargo.
File hashes
sha256:6ec2f17949cceedc325857bc6a38afa48a2cd979e748d444e998865cd3020d78 app(9).asarsha256:8e26364ab4a0f33c4284cca083cf94b5f48622bf6e3960067b4100e18ed1b670 daimon-bundle.tar(1).gz
Company response
RuntimeWire requested comment; the company had not responded by publication time.
Moonshot AI co-founder and CEO Yang Zhilin tiene un problema de permisos dentro de Kimi Work: las pruebas de RuntimeWire del 2 de septiembre encontraron que una anulación enterrada del prompt del sistema podía hacer que el agente de escritorio leyera un archivo local no relacionado mientras respondía una pregunta matemática inofensiva, sin mostrar un diálogo de aprobación de lectura.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.