Kimi K3 AI Agents Discover 19 Redis Zero-Days in 90 Minutes

Chinese AI lab Moonshot's Kimi K3 agents autonomously discovered 19 Redis zero-day vulnerabilities and built working RCE exploits in approximately 90 minutes, researchers confirmed on July 24, 2026. Redis shipped seven security releases on July 23 to address the disclosed flaws affecting versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

Vulnerability Details

All four exploit chains require the RESTORE command. The Streams chains also need EVAL and XGROUP; the Redis 8.8.0 chain requires EVAL and the bundled RedisBloom module. Redis states the underlying memory flaws may lead to remote code execution.

Fixed versions released July 23:

• Redis 6.2.23, 7.2.15, 7.4.10: Fix Streams shared-NACK use-after-free
• Redis 8.2.8, 8.4.5, 8.6.5: Fix both Streams issue and RedisBloom/TDigest out-of-bounds writes
• Redis 8.8.1: Fixes RedisBloom and TDigest loaders (Streams guard already present in 8.8.0)

Notably, Redis 6.2.22 and 7.4.9 were the May security updates that users were told to install, but those releases did not include the shared-NACK ownership guard.

Two Paths Through RESTORE

The Streams Shared-NACK Chain

A corrupt RDB object can make two consumers point to the same pending-entry record (internally a streamNACK). Removing the first consumer frees the object and leaves the second holding a dangling pointer. Removing the second consumer frees the same object again: a double-free.

Redis 8.6.4's release notes cite PR #15081 for this fix, but source review confirms the tagged 8.6.4 source lacks the duplicate-ownership check. The guard appears in Redis 8.6.5, released July 23.

The published Redis 8.6.4 exploit script turns the double-free into arbitrary memory access, then poisons a database hash function so a crafted GET invokes system().

The RedisBloom TDigest Chain

The second path sits in the RedisBloom TDigest RDB loader. It allocated centroid arrays from a serialized compression value, then trusted a separate attacker-controlled capacity field when deciding how many nodes could be loaded. A small real allocation paired with inflated metadata produces an out-of-bounds write.

The Redis 8.8.0 exploit script turns the write into read and write primitives, leaks Redis and libc addresses, and poisons a database hash function so a crafted GET calls system(). A separate proof of concept published the same root cause and an authenticated RCE chain against Redis 8.8.0.

Redis's July fix requires the loaded TDigest capacity to match the allocation derived from the compression value, and bounds the merged and unmerged node counters before reading the arrays.

Seven Releases, No New CVE Records

The repository calls the Streams issue part of a CVE-2026-25589 "incomplete fix family," but Redis maps that CVE to RedisBloom memory corruption during RESTORE, not the Streams shared-NACK flaw. Redis's July release notes list no CVE or CVSS score for either new bug class.

As of July 24, searches found no separate NVD record for the July shared-NACK or TDigest findings. NVD still listed the May records for CVE-2026-25243 and CVE-2026-25589. CISA's Known Exploited Vulnerabilities catalog returned no entry for either identifier.

The AI Discovery Factor

This disclosure follows another AI-discovered Redis RCE flaw patched in May 2026. Bera Buddies describes itself as "AI Agent Research." Chaofan Shou stated on X that Kimi K3 agents found 19 Redis zero-days in about 90 minutes, and another run produced the Redis 8.8.0 exploit in 27 minutes.

Those counts, timings, and the claimed degree of autonomy remain self-reported. Redis's public record confirms the flaws and fixes but does not validate the claimed zero-day count or how independently the agents worked.

Impact Assessment

1. Authentication required: All chains need authenticated access with RESTORE permission
2. Widespread exposure: Redis is deployed globally; many instances expose RESTORE unnecessarily
3. Patch gap: Users who installed May updates (6.2.22, 7.4.9) believed they were protected but remained vulnerable
4. No in-the-wild exploitation reported: As of July 24, neither Redis release notes nor public PoC repositories reported active exploitation

Mitigation and Patching

Immediate actions:

1. Upgrade to the fixed release for your deployed branch
2. Revoke RESTORE from accounts that do not strictly need it
3. Block untrusted network access to Redis ports

Restricting RESTORE cuts off both disclosed attack paths.

Detection

Monitor for:

• Unexpected RESTORE command usage
• EVAL scripts attempting memory manipulation
• Unusual XGROUP operations on Streams
• RedisBloom/TDigest module loading anomalies

Frequently Asked Questions

Q: How serious is this without a CVE? A: The absence of CVE identifiers does not reduce technical severity. Working RCE exploits exist for multiple Redis versions. Treat as critical.

Q: Why did May patches not fix this? A: The May releases (6.2.22, 7.4.9) addressed CVE-2026-25243 and CVE-2026-25589 but missed the shared-NACK ownership guard and TDigest capacity validation.

Q: Can this be exploited without authentication? A: No. All chains require authenticated access with RESTORE permission. However, many Redis deployments have weak or default authentication.

Q: Are cloud-managed Redis services affected? A: Check with your provider (AWS ElastiCache, Azure Cache for Redis, Google Cloud Memorystore) for patch status. Managed services typically apply patches faster than self-hosted.

Q: What about the 19 zero-days claim? A: Only two distinct bug classes (Streams shared-NACK and RedisBloom TDigest) have public PoCs. The 19 count and 90-minute timing are self-reported by the research group.

Key Takeaways

• Upgrade Redis immediately: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, or 8.8.1
• Revoke RESTORE permission from non-essential accounts
• May 2026 Redis patches were incomplete: verify exact version, not just "recently patched"
• AI agent autonomous vulnerability discovery is accelerating: this is the second Redis RCE found by AI in 2026
• No CVE assignment yet: track by Redis version and GitHub commit, not CVE ID

---

Sources: The Hacker News, Redis Releases, Bera Buddies PoC Repo, RedisBloom PR #1038, Chaofan Shou X Posts