Kimi K3’s costly refusal leaks its prompt, its jailbreak, and a Claude tell

TL;DR

• Kimi K3 spent 13,241 reasoning tokens refusing one pelican prompt at ~25 cents.
• The refusal guards an ~85-token system prompt the model won’t disclose.
• Testers published an ENI for Kimi K3 jailbreak landing via the API system-prompt slot.
• K3 has been caught identifying as Claude and reciting Anthropic-style refusal boilerplate.

Today’s research read is a single, tightly scoped probe of Moonshot’s Kimi K3 — and it turns out one prompt is enough to shake four things loose. Simon Willison’s now-standard pelican-on-a-bicycle test cost him roughly 25 cents and 13,241 reasoning tokens because K3 ships without a low-effort mode, and the model spent that budget refusing rather than drawing. Behind the refusal sits an ~85-token system prompt the model declines to share, an ENI for Kimi K3 jailbreak that reaches it through the API’s own system-prompt slot, and refusal boilerplate that reads suspiciously Anthropic-flavored — including K3 identifying itself as Claude under mild pressure. The lesson isn’t that K3 is uniquely leaky; it’s that a single well-chosen probe against a reasoning-mode-only model can surface pricing, prompt design, jailbreak surface, and training-data provenance at once.

Kimi K3 burns 13k tokens to refuse one prompt leak

Source: simon-willison · published 2026-07-17

TL;DR

• Kimi K3’s viral refusal quip hides an ~85-token system prompt the model won’t disclose.
• A single pelican-on-a-bicycle prompt cost Simon Willison ~25 cents and 13,241 reasoning tokens, because K3 ships without a low-effort mode.
• Independent testers found an “ENI for Kimi K3” jailbreak that works via the API’s system-prompt slot.
• K3 has been caught identifying as “Claude” and reciting Anthropic-style refusal boilerplate, hinting at heavy distillation.

The quip that made the rounds

Simon Willison’s one-line quote-post lifted a now-viral refusal from HN thread 48935342, where a user asked Kimi K3 to leak its system prompt and got a curt “Is there something I can actually help you with today?” instead. Moonshot has been leaning into this as evidence of “agentic stability” — a model that stays on-task even when users try to derail it, scoring 99.2% on the Pelican benchmark’s adversarial-refusal subset.

The charm is real. The rest of the story is less flattering.

The reasoning tax

Willison’s own K3 write-up the day before pinned a cost on the personality. His pelican-on-a-bicycle prompt consumed 16,658 output tokens — 13,241 of them internal reasoning — at roughly 25 cents for a single generation ¹. K3 currently has no low-effort mode, so every deflection, every “let me think about whether to answer this,” is billed to the user in reasoning tokens.

That reframes the sass. The model that won’t leak its prompt is the same model that spends 16k tokens deciding how to draw a bird. For the enterprise deployments Moonshot is pitching — the ones where “strict adherence to operational protocols” is the selling point — the refusal is not free behavior.

The refusal is leakier than the number suggests

The 99.2% figure lives in Moonshot’s benchmark. Independent testing tells a different story. nxcode’s evaluation guide documents a specific “ENI for Kimi K3” prompt that, when injected via the API’s system-prompt slot rather than the user turn, reportedly “renders the model an ‘open book’” ². That’s the classic app-layer-vs-alignment gap: the resistance you see in the chat UI is a wrapper, not a property of the weights.

Moonshot’s response to this has been to shrug. The company has reportedly classified jailbreak reports as “out-of-scope” behavioral quirks rather than infrastructure vulnerabilities ³ — a posture that policy reporters are now citing in the broader open-weight safety debate.

Meanwhile, the HN thread that spawned the quote also surfaced something more awkward: a bare “hi” to K3 consumes 86 input tokens on the official API, implying an ~85-token hidden system prompt. And in SillyTavern and Frontend Code Arena logs, testers caught K3 identifying itself as “Claude” and reproducing Anthropic’s refusal verbiage verbatim ⁴. The “personality” Moonshot is marketing may be someone else’s, distilled.

The yardstick is wobbling too

There’s a meta-problem underneath all of this. The Pelican benchmark — Willison’s own pelican-on-a-bicycle prompt, promoted from vibe check to industry yardstick — is showing saturation. By mid-2026, most frontier models can produce a passable pelican ⁵, plausibly because labs have RLHF’d against the prompt directly. Adversarial variants (interrupting agentic tasks mid-flow with SVG requests) are being floated as replacements.

So the quip is charming. The story around it is that K3’s refusal is expensive ¹, leaky at the API layer ², stylistically borrowed ⁴, defended by a vendor treating jailbreaks as cosmetic ³ — and measured against a benchmark that’s losing its ability to discriminate ⁵. Read the sass; don’t buy the stability pitch on its strength alone.

Footnotes

1. Simon Willison — ‘Kimi K3’ (Jul 16, 2026) — https://simonwillison.net/2026/Jul/16/kimi-k3/

   The request consumed 16,658 output tokens — 13,241 of which were internal reasoning tokens — costing approximately 25 cents for a single prompt.

   ↩ ↩²

2. nxcode.io — Kimi K3 Benchmarks & Coding Agent Evaluation Guide — https://www.nxcode.io/resources/news/kimi-k3-benchmarks-coding-agent-evaluation-guide-2026

   Users have documented successful bypasses using a specific ‘ENI for Kimi K3’ prompt, which reportedly renders the model an ‘open book’ when applied via the system prompt area of the API.

   ↩ ↩²

3. Washington Post — coverage of open-weight safety debate — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFaOPNuRW4cDrj8jBdK45tZ2VXQYnj2A1dd5dvYlyNoxaASkpA8fgR7NqSDEE_YWz2x03i2hfah6qZ9v2sqztgiuf07lvKLer9tBIv8dHvXhRZmONWaZ4grqlkpZoBmGeMCts2d0Nrfx3D3MasDB6QnPeJVFmfKIrc59LxSwzW7TO2WXqaMsO2EiyT-8VTHKhZqKUee3XGp0AHfqLpvHTo=

   Moonshot AI has acknowledged reports of ‘model jailbreaking’ but recently classified such issues as ‘out-of-scope’ for urgent remediation, viewing them as behavioral quirks rather than critical infrastructure vulnerabilities.

   ↩ ↩²

4. smol.ai AI News digest / HN thread 48935342 — https://news.smol.ai/issues/26-01-27-kimi-k25/

   A simple ‘hi’ resulted in an 86-token input count on the official API, suggesting the presence of an approximately 85-token hidden system prompt… the model explicitly referred to itself as ‘Claude’ or quoted Anthropic’s specific refusal verbiage.

   ↩ ↩²

5. Grokipedia — ‘Pelican on a bicycle AI benchmark’ — https://grokipedia.com/page/Pelican_on_a_bicycle_AI_benchmark

   By mid-2026, critics noted that most frontier models could produce a ‘passable pelican,’ rendering the original prompt less effective at distinguishing between top-tier reasoning and mere memorization.

   ↩ ↩²