Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say

Researchers have identified two remote code execution (RCE) vulnerabilities in Redis, attributed to an AI-driven research effort led by ‘Kimi K3 agents.’ The vulnerabilities were found in Redis versions 6.2.22 and 7.4.9, and later 8.8.0, and exploited by leveraging the RESTORE command. The Redis Streams vulnerability is a shared-ownership bug where a corrupt RDB object can cause two consumers to point to the same pending-entry record, leading to a double-free and ultimately arbitrary memory access. The RedisBloom TDigest RDB loader vulnerability involves an out-of-bounds write due to a mismatch between the allocated memory and a trusted attacker-controlled capacity field.

Redis released seven security updates on July 23 to address these issues. The initial discovery and exploitation timeline remain unverified, with ‘Kimi K3 agents’ claiming to have found 19 Redis zero-days in approximately 90 minutes and another run producing the 8.8.0 exploit in 27 minutes. Redis’s public record confirms the flaws and fixes, but does not independently validate the claimed zero-day count or the degree of autonomy of the AI agents.

Redis 6.2.22 and 7.4.9 were the initial targets in May, requiring further updates by July. It's important to check the exact branch version being used, not simply whether Redis has been recently patched. The vulnerability is linked to CVE-2026-25589, though Redis maps this CVE to RedisBloom memory corruption during RESTORE, not the Streams shared-NACK flaw. As of July 24, neither the NVD nor CISA’s Known Exploited Vulnerabilities catalog listed separate records for the July shared-NACK or TDigest findings.