Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Redis shipped seven security releases after researchers published PoCs for authenticated RCE flaws in Redis 6.x, 7.x, and 8.x, claiming Kimi K3 AI agents found 19 zero-days in 90 minutes.
Intelligence analysis by Llama
Redis patched two memory corruption chains — a Streams shared-NACK double-free and a RedisBloom TDigest out-of-bounds write — both reachable via RESTORE. Researchers claim Kimi K3 AI agents autonomously found 19 zero-days and built exploits, though Redis's public record confirms the bugs without validating the agent claims.
Some computer helpers called AI agents looked at a popular database program called Redis and found secret ways to break into it. The bugs let someone with a password take over the whole computer. The company already fixed the holes, but they had to fix some of them twice because the first try did not work.
Analysis
AI Agents in the Vulnerability Loop
The most provocative part of this disclosure is the framing rather than the patches. According to the article, Chaofan Shou posted on X that one Kimi K3 run found 19 Redis zero-days in about 90 minutes and another produced a working Redis 8.8.0 exploit in 27 minutes. The group behind the work, Bera Buddies, describes itself as "AI Agent Research." None of these timings or counts are independently confirmed; the article notes they "remain self-reported." Redis's public record confirms the bugs and the patches but does not validate the zero-day count or the agents' degree of autonomy. That distinction matters: the technical contribution is real and verifiable, while the AI narrative is a marketing claim layered on top of it, and operators reading the headline should not treat agent performance metrics as audited fact.
The Two Disclosed Chains
Both exploit paths require the RESTORE command, meaning an attacker needs authenticated access or the ability to plant a malicious RDB blob. The Streams path is a shared-ownership bug: a corrupt RDB object can make two consumers point to the same pending-entry record, so removing both consumers frees the same streamNACK object twice — one chunk, two frees. The Redis 8.6.4 PoC turns the double-free into arbitrary memory access, poisons a database hash function, and triggers system() via a crafted GET. The RedisBloom path is an out-of-bounds write in the TDigest RDB loader, where the code allocates memory from a serialized compression value but trusts a separate attacker-controlled capacity field. The 8.8.0 script reads and writes out of bounds, leaks Redis and libc addresses, and again poisons a hash function to call system(). A separate PoC for the same root cause targets Redis 8.8.0 independently.
Patches, CVEs, and the Operator Message
Redis shipped seven releases on July 23 to close both paths across every active branch. The Streams guard was incomplete in two May updates (6.2.22 and 7.4.9) that the vendor had previously told users to install, so operators who "recently patched" still need to verify their exact version. Redis assigned no new CVE records to either July flaw; the existing CVE-2026-25589 maps to a different RedisBloom issue, and searches by The Hacker News found no NVD entry for the shared-NACK or TDigest findings as of July 24. CISA's KEV catalog has no entry, and no in-the-wild exploitation has been reported. The mitigation is straightforward: restrict RESTORE to accounts that need it, block untrusted network access, and upgrade to the fixed release for the deployed branch.
Key points
- Redis shipped seven security releases on July 23, 2026 covering Streams shared-NACK and RedisBloom TDigest memory flaws
- Both exploit chains require the RESTORE command and authenticated access to reach code execution
- Researchers claim Kimi K3 AI agents found 19 Redis zero-days in about 90 minutes; the counts and autonomy claims are self-reported and not independently verified
- Two May updates (6.2.22 and 7.4.9) lacked the shared-NACK guard and must be re-patched even on recently updated systems
- No in-the-wild exploitation has been reported, no new CVE records were issued for the July bugs, and CISA KEV has no entry for either identifier
AI-assisted vulnerability discovery could compress patch timelines and surface obscure memory-safety bugs that human researchers miss, giving defenders a faster signal-to-fix loop. If the Bera Buddies reporting holds up, similar agentic techniques might be redirected toward defensive fuzzing and continuous auditing of open-source infrastructure.
The same autonomous capability that produced the Redis chains could be repurposed by attackers to find and weaponize zero-days faster than defenders can patch. Self-reported metrics from undisclosed "AI Agent Research" groups also muddy disclosure accountability — vendors may receive floods of low-quality or duplicate reports, and operators may struggle to distinguish validated CVE work from AI-generated noise.
