Kimi K3 AI Agents Discovered Redis Zero-Days and Built RCE Exploits in Under 90 Minutes

Researcher Chaofan Shou used 32 autonomous agents powered by the Kimi K3 LLM to find 19 zero-day memory-safety vulnerabilities in Redis, producing authenticated RCE proof-of-concepts within 27–90 minutes; Redis released multiple security updates on July 23, 2026 to patch the issues. Key findings include a stream consumer-group double-free leading to system() execution and a RedisBloom TDigest RDB loader heap overflow, all exploits requiring authenticated RESTORE permissions; mitigations include immediate patching, revoking RESTORE rights, and restricting network access.