Kimi K3 AI agents found flaws in Redis and assembled a working RCE exploit

On July 23, 2026, the Redis project shipped seven security releases at once. The trigger was researchers publishing ready-made proof-of-concept code demonstrating remote code execution (RCE) in unmodified builds of Redis 6.2.22, 7.4.9, 8.6.4 and 8.8.0 — given authentication.

Two paths through RESTORE

All four chains lean on the RESTORE command. The first path involves Redis Streams: a corrupted RDB object makes two consumers reference the same pending-entry record (streamNACK). Deleting the first consumer frees the object, and the second is left with a dangling pointer — one region of memory is freed twice. The published script turns this double-free into arbitrary memory access and ultimately calls system().

The second path is a buffer overrun in the TDigest loader of the RedisBloom module. The loader allocated memory according to a single serialized value but trusted a separate, attacker-controlled capacity field. A small real allocation paired with inflated metadata yields an out-of-bounds write; the scenario for 8.8.0 unfolds this into read and write primitives, extracts Redis and libc addresses, and again reaches system().

The May patches didn't help

A curious detail: builds 6.2.22 and 7.4.9 are precisely the May updates that Redis had recommended installing. But they contained no ownership check for the shared NACK, so by July they were vulnerable again. Developers advise checking the exact version of the branch rather than relying on the fact that Redis “was patched recently.”

The new releases (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1) close both issues, but their notes carry no dedicated CVE entries or CVSS scores. As of July 24, the NVD still showed only the May identifiers, and no entries were found in CISA's catalog of exploited vulnerabilities. No signs of exploitation in real-world attacks have been recorded so far. Until you update, it is recommended to revoke the RESTORE privilege from accounts that don't need it — this blocks both vectors.

The role of artificial intelligence

What sets this story apart is the authorship of the findings. According to Chaofan Shou, Kimi K3 AI agents discovered 19 zero-day vulnerabilities in Redis in about 90 minutes, and assembled a working exploit for 8.8.0 in 27 minutes. Redis's public documentation confirms the defects and fixes themselves, but the number of vulnerabilities, the timings and the degree of the agents' autonomy remain the researchers' own claims and have not been independently verified. This is already the second case this year in which an RCE vulnerability in Redis has been attributed to AI: the previous one was closed in May.

Source: The Hacker News