Ah, miss that one. But it still looks incomplete:

"Due to the specifics of Kimi K3’s hosting setup, UK AISI / CAISI ran a selective set of cyber evaluations."

... and

"Kimi K3’s overall cyber capability [...] was estimated from a single benchmark (ExploitBench"