Kimi K3 Agents Find Redis Zero-Days and Build a Working RCE Exploit

Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0 stock builds

Researchers at Bera Buddies reported that autonomous agents running on Moonshot AI's Kimi K3 found 19 Redis zero-days in about 90 minutes and, in a separate run, produced a working remote code execution exploit for Redis 8.8.0 in 27 minutes. Two attack paths were published with authenticated proof-of-concept code, both requiring access to the `RESTORE` command: a streams consumer-group shared-NACK double free, where two consumers point at the same pending-entry record, and an out-of-bounds write in the RDB loader of the bundled RedisBloom TDigest module. Redis shipped seven security updates on July 23, 2026 (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1). No in-the-wild exploitation was reported as of publication. The vulnerability counts, timings, and the claimed degree of agent autonomy are self-reported and were not independently verified by Redis

Memory-corruption bugs in Redis stream and module deserialization paths, surfaced at machine speed by an open-weight model driving autonomous vulnerability-research agents, which compresses the window between a codebase becoming a target and a working exploit existing