FortiSandbox RCE Under Active Attack, CISA Deadline Sunday

The safety assumption was simple: capable offensive AI stayed behind a monitored, rate-limited, abuse-logged API. That assumption expires on July 27, when Moonshot publishes all 2.8 trillion weights of Kimi K3. GLM-5.2 already matches Anthropic's Opus 4.5 on the 'The Last Ones' cyber benchmark. Operators are running these models on 4×H100 nodes as an unlogged, self-hosted exploit and kernel assistant, and the performance engineering is drawing praise. A threat actor with commodity GPUs gets frontier coding capability with no guardrails and no telemetry. Expect engineers pulling the same weights as shadow AI within days of the release.

Provenance is the harder problem, and less of it is settled fact than the vendor debate suggests. Anthropic has accused Moonshot of illicitly distilling Claude. Thinking Machines' Inkling inherits DeepSeek-V3 architecture and Kimi K2.5 synthetic training data. Neither claim has a clean resolution, and there is no SBOM standard for model weights to check against. Deploying these models is closer to running unsigned third-party binaries than adopting a vetted vendor product. The sharper data point: Inkling was demonstrated autonomously writing its own fine-tuning job, evaluating the result, and swapping itself onto the new weights. That breaks the assumption that model artifacts are static, signed, and reviewed before deployment.

Nine reports converge on the same nuance: this trade relocates risk, it doesn't remove it. A US export directive black-holed Anthropic's Fable 5 globally for 18 days. Closed-API dependency carries availability and repricing exposure. Self-hosting swaps that exposure for provenance, integrity, and multi-tenant-isolation burdens that land on the deploying team, not the vendor's. The mitigation is unglamorous and dated: publish an approved-models allow/deny list enforced at the egress proxy, add hash-integrity and hosting-jurisdiction checks to the MLOps gate, and require human approval before any pipeline promotes self-modified weights. All of it needs to be in place before July 27, when local reproduction stops being hard.