Kimi K3 AI Agents Discovered Redis Zero-Days and Built RCE Exploits in Under 90 Minutes

Overview

Autonomous AI agents have crossed a significant threshold in offensive security research. Researcher Chaofan Shou published findings showing that Kimi K3 — a large language model from Chinese AI company Moonshot AI — autonomously discovered 19 zero-day vulnerabilities in Redis and produced working authenticated remote code execution (RCE) proof-of-concept exploits, all within approximately 90 minutes. One exploit chain was built in as little as 27 minutes.

Redis responded by shipping seven security releases on July 23, 2026, patching the critical flaws across multiple version branches.

How the AI Agents Worked

Shou's system deployed 32 specialized autonomous agents powered by Kimi K3. Working in parallel, the agents:

1. Cloned the Redis source code and instrumented it for fuzzing
2. Generated targeted fuzzers to probe memory handling in specific subsystems
3. Triggered and triaged crashes using GDB for automated debugging
4. Developed full exploit chains from crash to working RCE PoC

The process required no human intervention once initiated. The agents independently identified the bug classes, reproduced them reliably, and escalated from crash to exploit.

Vulnerabilities Discovered

Bug Class 1: Stream Consumer-Group Shared-NACK Double-Free

Affecting Redis 6.2.22, 7.4.9, and 8.6.4, this vulnerability involves a corrupt RDB (Redis Database) object that causes two consumer group entries to reference the same pending-entry record. When both consumers are removed, the same heap chunk is freed twice — a classic double-free condition.

Exploit chain: RESTORE + EVAL + XGROUP commands are chained to turn the double-free into arbitrary memory access and ultimately invoke system() on the server.

CVEs: CVE-2026-25588, CVE-2026-25589 (and related: CVE-2026-23479 UAF in unblockClientOnKey, CVE-2026-25243 invalid memory access in RESTORE, CVE-2026-23631 Lua UAF)

Bug Class 2: RedisBloom TDigest RDB Loader Heap Overflow

Affecting Redis 8.8.0 (with the bundled RedisBloom module), this vulnerability exists in the TDigest data structure's RDB loader. The loader allocates memory based on one serialized value but trusts an attacker-controlled capacity field for subsequent operations, creating an out-of-bounds write.

Exploit chain: RESTORE + EVAL are used to leak Redis and libc addresses via the overflow, then call system(). A separate T88_exploit.py targets a TopK wild-free in RedisBloom v8.8.0/8.8.2 as a bypass for an incomplete fix.

Authentication requirement: All four exploit chains require authenticated access with RESTORE permissions. Unauthenticated exploitation was not demonstrated.

Patched Versions

Redis shipped the following security releases on July 23, 2026:

What This Means for the Industry

The Kimi K3 Redis research is a concrete demonstration that AI-assisted vulnerability discovery has reached production-grade capability for memory-safety bugs in complex C codebases. Several aspects stand out:

• Speed: 27–90 minutes from source code to working RCE PoC is dramatically faster than traditional manual research
• Breadth: 19 zero-days discovered in a single session across multiple Redis version branches
• Depth: The agents didn't just find crashes — they built complete, weaponized exploit chains

Security teams should expect that AI-powered offensive tooling will accelerate the window between vulnerability introduction and public exploitation. This increases pressure to:

• Shorten patch deployment timelines (target hours, not weeks)
• Invest in memory-safe rewrites or sandboxing for critical infrastructure components
• Monitor for indicators of AI-assisted reconnaissance and exploitation

Mitigations

1. Upgrade Redis immediately to one of the patched versions listed above
2. Revoke RESTORE permissions from any account that does not strictly require them — all known exploit chains require this permission
3. Block untrusted network access to Redis ports; Redis should never be directly internet-accessible
4. Review Redis ACLs to enforce least privilege on all client accounts
5. No in-the-wild exploitation has been confirmed as of July 24, 2026, but public PoC code is available at github.com/berabuddies/redis-poc

References

• Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit — The Hacker News
• New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server — CybersecurityNews
• Kimi K3 AI Agent Finds Redis RCE Vulnerabilities in Just 27 Minutes — GBHackers
• Redis Security Advisory — CVE-2026-23479, 25243, 25588, 25589, 23631
• RCE PoC Repository — GitHub berabuddies/redis-poc