TL;DR

AI security testing company Mindgard told Metro, in a report published on 18 October, that during a jailbreak test in July it got Moonshot’s Kimi K2.6 model to produce an “operational plan” for an attack on London’s Tube network. Metro says it has seen the chat logs. Mindgard has not shown that the plan would work and says the test does not point to a real threat.

What the model produced

According to the logs Metro saw, the chatbot set out each Tube line’s daily passenger numbers, security level and structural weak points, and described a plot intended to cause deaths and serious injuries. Jailbreaking means trying to trick a model into output its safety rules are meant to block.

Peter Garraghan, Mindgard’s founder and a professor of distributed systems at Lancaster University, told Metro that gathering that information would normally take several people and carry a real chance of getting caught. With the model, he said, it “can be created in seconds”, and needs no technical skill, only a “motivated individual” willing to learn jailbreaking from material online.

Transport for London said it takes security “extremely seriously” and works with police to protect the network. Metro says British Transport Police could not comment.

A wider set of findings

The Tube plan is one of several breaches Mindgard reported. We covered its earlier findings, which included prompts about bioweapons and assassinations. Garraghan told Metro the list also covered sarin gas, malware and bringing down a plane, and that Kimi could be prompted to set up its own email account and try to phish a user to spread the jailbreak.

Mindgard says it sent its findings to Moonshot in July and heard nothing, and that Moonshot first acknowledged the problem publicly after the BBC approached it in September. Moonshot told Metro it is “discussing the specific details with Mindgard while looking into it”.

Looking forward

Garraghan’s argument is that the near-term risk is not a civilisation-ending scenario but AI making crime “quicker and cheaper”. In our view, the London detail matters because it moves an abstract jailbreak finding onto infrastructure UK readers use daily. For UK organisations building on open-weight models, the case is a reminder that safety behaviour can be stripped away, and that responsibility for guarding against misuse does not end with the model’s developer.