Reporting record #
Finding
Kimi Desktop 3.1.10 hides an internal, office/VPN-only KTH gateway behind five rapid clicks on its Version row, allowing personal-token import of off-membership-quota Kimi, GPT and Codex models from free-tokens.msh.team.
How we verified
Methods: reverse engineering, testing, data analysis.
Static analysis of Kimi Desktop 3.1.10 found a concealed BYOK feature absent from 3.1.5. Five rapid clicks on the Version row invoke the BYOK reveal handler and persist the setting in byok-availability.json. The interface identifies the service as “KTH Gateway (Internal),” defaults to https://free-tokens.msh.team/v1, requires a personal token and says access is limited to an office network or VPN. The importer authenticates to /v1/models and /v1/models/api.json, accepts kimi-, gpt- and codex-prefixed models, and configures Kimi and OpenAI Responses providers. The application stores the complete token in byok-providers.json without application-layer encryption and also writes it into the daemon configuration. Runtime testing reproduced the hidden interface without entering a token or contacting the model endpoints.
We extracted the supplied 3.1.10 ASAR, decoded its obfuscated string tables and traced the renderer click handler through the preload IPC bridge to the main-process BYOK implementation. We compared the resulting code and strings against Kimi Desktop 3.1.5, which contained no BYOK, KTH or free-tokens.msh.team artifacts. We then reproduced the interface on an installed Windows copy of Kimi Desktop 3.1.10 by opening Kimi Work Settings, scrolling to About and clicking the Version row five times quickly. The internal gateway panel appeared with the hard-coded endpoint and office/VPN disclosure. No token was supplied, no connection test was performed and no authenticated request was sent.
Tested versions: Kimi Desktop 3.1.10 (3.1.10+e0c4c9980), compared with Kimi Desktop 3.1.5 (3.1.5+c88420152).
Reproduction
RuntimeWire independently reproduced the core finding.
Install and launch Kimi Desktop 3.1.10. Open Kimi Work Settings. Scroll to the bottom of the settings pane and locate About. Click the Version row five times rapidly, keeping each interval under one second. Scroll upward to Model Sources. Confirm that “KTH Gateway (Internal)” appears with https://free-tokens.msh.team/v1 as the default Base URL. Do not enter a token or select “Test Connection & Import Models.”
Company response
RuntimeWire requested comment; the company had not responded by publication time.
Kimi Desktop 3.1.10 shipped with a concealed configuration panel for Moonshot AI's internal multi-model gateway. Five rapid clicks on the app's version number reveal https://free-tokens.msh.team/v1
, which the client identifies as "KTH Gateway (Internal)."
The route is not a public free API. Access requires a Moonshot office network or VPN and a personal bearer token. The client uses GET /v1/models
to validate access, while GET /v1/models/api.json
supplies a catalog of available models and their capabilities.
That catalog reaches beyond Moonshot's own models. The gateway imports kimi-*
, gpt-*
, and codex-*
model families, with GPT and Codex requests using the OpenAI Responses protocol. Conversations routed through it are labeled "KTH · not billed to membership," establishing that Moonshot employees have an off-quota path to Kimi and at least some OpenAI model capacity from inside the public desktop client.
Error messages add another detail: failed requests can refer to a congested "KTH upstream pool." That language suggests the gateway brokers access through shared upstream capacity rather than serving as a simple alternate hostname for Kimi's consumer API. The client does not establish whether Moonshot purchases OpenAI capacity directly or reaches it through another internal pool.
Moonshot's official Windows download endpoint served Kimi 3.1.10 on August 17th. The corresponding macOS endpoint still served version 3.1.9, so the finding is confirmed for the current Windows release rather than every Kimi Desktop build.
Five clicks reveal the gateway, not its credentials
The trigger is simple: open the version screen and click the version number five times in rapid succession. The resulting panel exposes the KTH Gateway configuration and its access requirements. A user must be connected to Moonshot's office network or VPN and provide a personal bearer token before GET /v1/models
will validate the connection.
The click sequence is therefore a discovery mechanism, not the security boundary. Publishing the hostname does not give outsiders access, and the free-tokens
label is not evidence that Moonshot offers a free public API. The meaningful disclosure is that the production client contains Moonshot's employee route for model access outside Kimi membership billing.
The hostname is strongly tied to Moonshot's corporate infrastructure. The kimi.cn
registration lists admin@msh.team
, and Moonshot personnel have publicly used @msh.team
email addresses. Moonshot also says the company was founded in 2023, the year the msh.team
domain was registered.
Moonshot's staff gateway spans Kimi and OpenAI protocols
The model catalog makes this more than a hidden setting for testing Kimi. It includes kimi-*
, gpt-*
, and codex-*
entries and records model capabilities for the desktop client. GPT and Codex traffic follows the OpenAI Responses protocol, indicating that Moonshot built the gateway to normalize access across its own models and OpenAI-style services.
The client does not reveal which OpenAI models employees can currently access. Nor does it explain what "KTH" stands for, who besides employees can receive bearer tokens, or whether prompts and outputs are logged centrally. Those remain operational questions that the shipped configuration cannot answer.
The gateway matters because Kimi Desktop has moved beyond a wrapper for web chat. Moonshot markets Kimi Work as a local agent that reads and writes files, runs Python and shell commands, operates signed-in browsers, schedules unattended tasks, and coordinates large batches of sub-agents. Model routing, local permissions, browser automation, and subscription accounting now meet inside the same application.
That makes internal configuration hygiene more consequential. The public Windows installer disclosed Moonshot's internal hostname, authentication flow, model-catalog endpoints, protocol choices, billing treatment, and references to a shared upstream pool. It did not disclose a usable token or bypass the office-network requirement.
The timing adds context. Moonshot temporarily d new Kimi subscriptions in July after demand for Kimi K3 strained available computing capacity, according to Reuters. Less than a month later, its Windows client was carrying a route for office or VPN users whose conversations were explicitly marked as not billed to membership. The software does not show how much capacity Moonshot allocates to that pool or whether internal traffic competes with retail demand.
Shipping employee controls inside production software is common. In this case, five clicks exposed something more specific than a diagnostic menu: Moonshot's off-quota, multi-model gateway for Kimi, GPT, and Codex access inside its public desktop client.