Kimi client patches arbitrary-command vulnerability via local embedded server

KimiDevs · x · 2026-09-24

KimiDevs shipped a round of client fixes, headlined by a security patch:

Security: fixed a vulnerability letting malicious web pages run arbitrary commands through the local embedded server
Stability: long conversations freezing on open, streaming stutter, and excessive mobile memory use
Agents: subagent model showing unconfigured and not applying; endless spinner after deleting a session; task notification cards losing stream order; Swarm card display issues
Polish: full-width rounded Markdown tables, readable cron job details, deduped address-bar suggestions, full Bash command in the expanded tool panel

More from coding & agent