Why a security company hardened Kimi's coding CLI, and why we're giving the fork away.

At DefectDojo we're genuinely excited about what AI can do for security teams. We built Sensei, the AI engine behind DefectDojo’s auto-remedation capabilities for AppSec and CSPM, and Claude models do heavy lifting across our company every single day.

But you know what I don't love about AI? My Anthropic bill. 💀

So when Moonshot AI released Kimi K3 in July with open weights, we paid attention. The capabilities are not hype. K3 sits within three points of Claude Fable 5 on the Artificial Analysis Intelligence Index (57 vs 60), takes the top spot on Frontend Code Arena (1,679 Elo to Fable's 1,631), and solves 2.8x more coding tasks per dollar on the DeepSWE benchmark. It lists at $3 per million input tokens and $15 per million output. That is literally Sonnet pricing (Claude Sonnet 5's standard list price is the same $3/$15) for a model within shouting distance of Fable, which lists at $10/$50.

At that price the math changes. "Run an agent on every finding" stops being the line item your CFO circles in red. Autonomous pipelines you would never fund at frontier prices suddenly pencil out.

There's a catch, and the catch is why this post exists.

Open weights don't mean safe to run

Two separate problems hide inside "just use the cheap model."

The first is where your tokens go. Our context windows are full of security findings and customer-adjacent data, and we're not sending that to any API we haven't vetted, at any price. Open weights solve this completely: you pick the inference. We point ours at US-hosted inference with the privacy and retention guarantees we need. Your own GPUs work too. Control over the data path is the entire point of open weights.

The second is the agent harness itself, and this one gets ignored. A coding CLI runs with your shell, your filesystem, and your credentials. Before we let kimi-code (Moonshot's coding CLI, their answer to Claude Code) anywhere near real work, we audited it the way we'd audit anything with that much reach. It's genuinely nice software. It also shipped with behaviors we would flag in any customer's environment. So we did what we tell everyone else to do with findings: triage, fix, ship.

What we hardened

Ten pull requests on top of upstream v0.34.0, each one reviewable on its own:

• Auto mode no longer auto-approves shell commands or URL fetches by default. Least privilege is the default, not the ceiling.
• Configured permission rules are actually enforced, and approvals fail closed. If the harness can't decide, it refuses.
• Headless runs refuse and exit when something needs approval, instead of hanging forever.
• Wildcard Bash allow-rules match one simple command, not anything that happens to start with the right prefix.
• File tools re-check every path against its symlink target, so a symlink can't walk the agent out of the workspace.
• Sensitive-file protections extend to Grep and Glob, not just file reads.
• Writing to files that something later executes (shell profiles, hooks) requires approval first.
• Web fetches block private addresses more aggressively, and downloaded artifacts get integrity checks.
• The plugin catalog is pinned and unattended native self-updates are off. An agent should not update itself while nobody is watching.
• Telemetry is opt-in, and the phone-home tips fetch has a kill switch.

Some of these are bugs by anyone's definition. Others are opinionated defaults for our threat model: an agent working unattended inside a company whose repos are full of security context. Take what fits yours.

How we actually run it

We still pay Anthropic, happily. Fable 5 does the planning, the adversarial review, and anything investigative, because it's the best model in the world at exactly that. The hardened Kimi CLI does the well-scoped execution work in between, where volume drives the bill, not brilliance. Plan expensive, execute cheap, review expensive. Your Anthropic budget goes to the problems that deserve it.

Get it

The fork is public and MIT-licensed: github.com/DefectDojo/kimi-code, baseline upstream v0.34.0, hardening in PRs #1 through #10. If you're dabbling with Kimi for engineering work, start from the hardened fork instead of stock defaults.

And if you find something we missed, file an issue. Finding problems in security tools is the most DefectDojo thing there is.

Happy coding!

About DefectDojo: DefectDojo is the open source unified vulnerability management platform, enabling security teams to focus on prioritizing and remediating the most critical vulnerabilities. Parse any security finding, aggregate across your stack, and report on your security posture and compliance.