AI security research
32 Kimi K3 Agents Collaborate to Uncover Redis Memory Vulnerabilities, Prompting Fixes Across Multiple Release Branches
Researchers claim that 32 Kimi K3 agents automatically generated fuzz harnesses, analyzed crashes, and built Redis remote code execution PoCs, with the fastest exploit chain completed in 27 minutes. Redis has patched the related `RESTORE` memory issues, but exploitation requires valid credentials and specific command permissions, while claims about the agents’ autonomy and “19 zero-days” still rely primarily on the researchers’ own account.
Bera Buddies researcher Chaofan Shou has disclosed an automated vulnerability research project conducted with Moonshot Kimi K3. Thirty-two specialized agents worked concurrently to clone the Redis source code, build fuzz harnesses, instrument the code with debugging tools, and use GDB to trace the root causes of crashes. The team claims it found 19 previously unknown issues in about 90 minutes, with a complete exploit chain targeting Redis 8.8.0 developed in 27 minutes. A public repository provides several non-destructive PoCs covering Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.x.
The primary attack surface centers on how `RESTORE` handles untrusted serialized data. One path described by the researchers involves Streams consumer groups: specially crafted data could cause two consumers to share a pending-entry structure, leaving a dangling pointer after one is freed and resulting in a double-free or use-after-free. Another issue lies in RedisBloom, a component distributed with Redis, where malicious TDigest data could trigger a heap buffer overflow during restoration. Redis’s official documentation also lists CVE-2026-25588 and CVE-2026-25589, confirming that crafted `RESTORE` input can cause invalid memory access and potentially lead to remote code execution.
These are not unauthenticated, wormable vulnerabilities that can simply be used to scan the internet. An attacker must first obtain valid Redis credentials and permission to run `RESTORE`; some Streams paths also require `EVAL` and `XGROUP`. Nevertheless, the ability to escalate low-privilege credentials into native code execution would still change the threat model. On July 23, Redis released patched versions including 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1. Operators should upgrade and tighten ACLs for dangerous commands.
The methodology itself may be the more significant development: the agents were reportedly able to connect test generation, compilation, debugging, and PoC validation instead of merely answering static code questions. However, neither Redis nor Moonshot has independently confirmed the claim of “19 zero-days,” the reported timelines, or the degree of human involvement. The publicly available materials are also insufficient to reconstruct the full 32-agent orchestration. Future evaluations should record every tool trace, human prompt, failed attempt, and the total inference cost to determine whether this is a reproducible security workflow or a selectively presented success story.