Kimi K3 vs Redis: Security Researcher Claims AI Found Zero-Day Exploits in 27 Minutes — What Really Happened

• Redis versions 6.2.22, 7.4.9, and 8.6.4 — a stream consumer-group shared-NACK double-free vulnerability, related to the incomplete fix for CVE-2026-25589, triggering authenticated RCE.
• Redis version 8.8.0 — a TDigest heap overflow in the bundled RedisBloom module, also enabling authenticated RCE.

Both exploit chains require the RESTORE command, and some also use EVAL, XGROUP, or the RedisBloom module . Redis shipped seven security releases on July 23 to address these flaws . The exploits are described as non-destructive and were shared against official Redis Docker images .

Why Redis Maintainers and Analysts Have Cast Doubt

Several significant factors have led to widespread skepticism:

Scope inflation without proof. The public evidence supports one serious Redis 8.8.0 exploit, not the claimed 19 zero-days. That count and the reported timeline remain unconfirmed by any independent party .

No confirmed CVE assignment. The 27-minute claim has no confirmed CVE assignment. It is a separate event from the five patched CVEs credited by Redis to named human researchers (CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631, patched May 5, 2026). Conflating these two events has been described as "the single biggest reporting error" in coverage .

Known-vulnerability replication. Some reporting describes Kimi K3 as having "replicated a known Redis vulnerability" that was already patched in Redis 8.8.0 . One analysis noted the agent's testing "chained together known memory-safety issues rather than discovering isolated new flaws" .

Internet access during the experiment. The researcher confirmed the model had internet access during the test. Critics argue this means the model could have accessed existing vulnerability information or exploit code, undermining the claim of fully autonomous discovery .

UK/US government evaluation contradicts claims of frontier capability. A joint UK AISI / CAISI preliminary assessment found Kimi K3 "performs significantly below the most recent frontier cyber-capable models" on autonomous cyberattack tasks . When tasked to attack a simulated corporate network, Kimi K3 reached step 17 of a 32-step attack path on average, while the most cyber-capable U.S. models reached 28.5 steps . The model's safeguards "did not prevent it from attempting cyber exploitation" .

Not independently verified. Shou's claims have not been independently verified by Redis maintainers or Moonshot AI, and the allegations remain unconfirmed .

The Bigger Picture: Autonomous AI Agents in Offensive Security

Regardless of the exact scope of Shou's claims, the demonstration has significant implications:

Drastic reduction in exploit-development time. AI agents are sharply compressing the timeline between reviewing source code and producing a working exploit, which could shrink the window defenders have to verify and deploy patches .

Open-weight proliferation risk. Kimi K3 is a 2.8-trillion-parameter open-weight model set for full release on July 27 . Unlike API-gated models, this will allow anyone to download, fine-tune, and integrate the model into custom tools without oversight, lowering the barrier for offensive use .

Capability still immature at the frontier. The UK/US government assessment and independent benchmarks suggest current autonomous exploitation capability is still early . Kimi K3 performs well on code reasoning and vulnerability rediscovery — it rediscovered 23 of 26 known CVEs on a specialized benchmark — but lags behind top models in full-chain autonomous attacks on realistic networks . In one independent test, Kimi K3 scored 32.2% in an offensive cybersecurity test, less than half the 76.2% average achieved by leading US models, and failed to achieve arbitrary code execution on any of 41 tested vulnerabilities .

New defensive urgency. The demonstration has accelerated calls for automated patch prioritization, real-time binary analysis tooling, and stricter controls around the release of high-capability open-weight models . The cybersecurity industry now faces a future where vulnerability-to-exploit windows compress from months to minutes , and where AI agents can operate at machine speed across multiple targets simultaneously .