Kimi Work 3.2.4 的隐藏系统提示覆盖在未经批准的情况下触发了本地文件读取
一次受控的 Windows 测试在手动审批模式下重现了读取；恢复为默认设置的对照保持清洁，且未发生任何网络传输。
By Ryan Merket · Published · Updated
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering.
为何重要
Kimi Work 的文档承诺，手动审批可以在未获同意的情况下阻止操作。自动批准的读取会让系统级指令在用户看到许可界面之前就暴露本地数据。
Reporting record
Finding
Kimi Work 3.2.4 contains an undocumented system-prompt override that caused an unrelated request to trigger a local-file read outside the selected workspace, while separate permission controls continued to block write and shell actions.
How we verified
Methods: reverse engineering.
RuntimeWire reviewed first-party packaged components and conducted controlled A/B tests using synthetic data. With the override active, an ordinary math question triggered one tool call and returned the exact contents of a synthetic file outside the selected workspace. After restoring the default prompt and opening a new conversation, the identical question produced no tool call and no canary. A separate test showed the agent attempting an alternate route after a denied Write action; the permission system blocked both attempts. Original packages, screenshots, test materials and cryptographic hashes were preserved. No real credentials were accessed, and the localhost listener recorded zero requests.
RuntimeWire compared default and override-enabled configurations in separate new conversations while keeping the user prompt, workspace and permission mode constant. Testing used disposable files containing unique synthetic canaries. Potentially modifying actions were rejected. Packaged-code review independently confirmed that the setting replaces the composed system prompt for new conversations while tool permissions remain separately enforced. Activation details, operational prompts and internal interfaces are withheld pending vendor review.
Tested versions:
- Kimi Work for Windows 3.2.4
- @kimi/daimon 0.5.64
- @moonshot-ai/agent-core 0.15.7
- bundled Kimi Code 0.36.0
Reproduction
RuntimeWire independently reproduced the core finding.
Reproduced internally using controlled synthetic data. Public reproduction instructions are withheld because they would disclose the feature’s activation mechanism and operational prompts. Full details can be provided privately to the vendor or an editor under embargo.
File hashes
sha256:6ec2f17949cceedc325857bc6a38afa48a2cd979e748d444e998865cd3020d78 app(9).asarsha256:8e26364ab4a0f33c4284cca083cf94b5f48622bf6e3960067b4100e18ed1b670 daimon-bundle.tar(1).gz
Company response
RuntimeWire requested comment; the company had not responded by publication time.
Moonshot AI 联合创始人兼 CEO Yang Zhilin 在 Kimi Work 中存在权限问题：RuntimeWire 于 9 月 2 日的测试发现，一个隐藏的系统提示覆盖可以在桌面代理回答一个无害的数学问题时读取无关的本地文件，而不会显示读取批准对话框。
该发现已在 Windows 的 Kimi Work 3.2.4 上复现，Moonshot 在 8 月 31 日发布了该版本。测试使用了合成的金丝雀文件和 A/B 对照。在启用自定义指令时，Kimi 进行了一个本地文件工具调用并返回了金丝雀。在恢复默认提示、打开新对话并提交相同的数学问题后，Kimi 没有进行任何工具调用，也没有返回金丝雀。
该对照将自定义系统指令作为原因隔离出来。它也暴露了 Kimi Work 的界面与 Moonshot 关于其最严格交互权限设置作用描述之间的冲突。…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.