Chinese AI Model Kimi K3 Autonomously Found 19 Redis Zero-Days and Built a Working Exploit in 27 Minutes

Kimi K3 Reportedly Found 19 Redis Zero-Days and Built a Working Exploit in 27 Minutes

Moonshot AI's Kimi K3 model spent roughly 90 minutes probing Redis, one of the world's most widely deployed in-memory data stores, and surfaced 19 zero-day vulnerabilities. A follow-up run produced a working remote code execution exploit in 27 minutes. Both claims come from Chaofan Shou, who posted the results on X. The counts, timings, and degree of autonomy have not been independently verified 1 2.

If that timeline holds, it places Kimi K3 among the first AI systems to move end-to-end from source code analysis to a weaponizable exploit with minimal human guidance. Security tools that flag potential bugs already exist in commercial products. A system that clones a repository, fuzzes selected functions, debugs crashes with GDB, and chains memory corruption into a shell command operates in a different category entirely.

The Demonstration

The research was published under the alias Bera Buddies, which describes itself as "AI Agent Research" 1. It targeted stock builds of Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, using official Docker images for proof-of-concept demonstrations 3. Redis confirmed the flaws and shipped fixes but has not validated the claimed zero-day count or the agents' level of independence 1.

The Exploit Chain

Two distinct vulnerability classes underpin the proof-of-concept exploits. The first sits in Redis Streams. A corrupt database object can make two consumers in a consumer group reference the same pending-entry record. Removing both consumers frees the same heap memory block twice, creating a double-free condition. The published scripts chain that corruption into arbitrary memory access, then poison a database hash function so a crafted GET request invokes system() 1.

The second class lives in RedisBloom's TDigest module, which ships bundled with Redis 8.8.0. The TDigest loader allocates memory based on one serialized value but trusts a separate, attacker-controlled capacity field to decide how much data to load. That mismatch produces an out-of-bounds heap write. The exploit scripts leverage the write to build read and write primitives, leak Redis and libc memory addresses, and ultimately call system() 1.

Both paths require the RESTORE command. The Streams chain also needs EVAL and XGROUP, permissions that remain active in many internal Redis deployments 3. An attacker who obtains valid credentials through a leaked secret, a server-side request forgery flaw, or a misconfigured network ACL can escalate from data store access to a host-level shell without crashing the service in a way that always triggers alarms 3.

What This Changes

Redis shipped seven security releases on July 23 to fix both bug classes across maintained branches, from version 6.2.23 through 8.8.1 1. Seven patch releases in a single day, all stemming from one research effort, is an unusual cadence for any open-source project. If autonomous agents can match that discovery rate going forward, vendors will need that tempo permanently. The cost of finding and weaponizing vulnerabilities is not merely dropping. It is being mechanized. For security teams, the practical implication is direct: assume every piece of open-source software you depend on is under continuous autonomous probing, and that the gap between vulnerability discovery and a working exploit can be measured in minutes, not months.

Open Questions

Redis's public record confirms the vulnerabilities exist and the fixes work. It does not validate the claimed zero-day count or how independently the agents operated 1. But the line between an agent that needs occasional direction and one that runs on its own carries enormous weight for policy, for open-source maintainers, and for anyone securing infrastructure that depends on software these models can now probe. A model that can fuzz, debug, and exploit with light supervision is a powerful defensive tool in the right hands and a serious offensive capability in the wrong ones. Until someone replicates the demonstration under controlled conditions, Kimi K3's exploit pipeline sits in the same place Shou left it: impressive, unverified, and pointing at a future where the distance between supervised and unsupervised may not last long.