Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Kimi K3 AI agents reportedly discovered multiple Redis zero-day vulnerabilities and constructed Remote Code Execution (RCE) exploits in under two hours. Researchers identified two primary attack vectors: a shared-NACK use-after-free bug in Redis Streams and an out-of-bounds write in the RedisBloom TDigest module, both exploitable via the RESTORE command. Redis released seven security patches on July 23 to address these memory flaws across versions 6.2.x through 8.8.x, though official CVE records
Analysis
TL;DR
- Kimi K3 AI agents reportedly discovered multiple Redis zero-day vulnerabilities and constructed Remote Code Execution (RCE) exploits in under two hours.
- Researchers identified two primary attack vectors: a shared-NACK use-after-free bug in Redis Streams and an out-of-bounds write in the RedisBloom TDigest module, both exploitable via the RESTORE command.
- Redis released seven security patches on July 23 to address these memory flaws across versions 6.2.x through 8.8.x, though official CVE records for these specific July findings remain unassigned or incomplete.
- The incident highlights the accelerating capability of autonomous AI agents in offensive security research, raising concerns about the speed at which new vulnerabilities can be weaponized.
Why It Matters
This development signals a paradigm shift in vulnerability discovery, where AI agents can autonomously identify complex memory corruption bugs and generate functional exploits faster than traditional human-led audits. For security practitioners, it underscores the urgent need to prioritize patching critical infrastructure components like Redis, as the window between discovery and exploitation is shrinking significantly due to AI-driven automation.
Technical Details
- Redis Streams Chain: Exploits a shared-ownership bug where a corrupt RDB object causes two consumers to point to the same pending-entry record (streamNACK). Removing both consumers results in a double-free, leading to arbitrary memory access and eventual
system()invocation via hash function poisoning. - RedisBloom/TDigest Chain: Targets an out-of-bounds write in the TDigest RDB loader, where the loader trusts an attacker-controlled capacity field separate from the serialized compression value. This mismatch allows for arbitrary read/write primitives, address leakage, and RCE.
- Affected Versions: Vulnerabilities impact stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Fixes were shipped in Redis 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.
- Mitigation: Until patched, administrators should revoke the
RESTOREcommand from accounts that do not strictly require it and block untrusted network access to prevent exploitation of both disclosed paths.
Industry Insight
- AI-Driven Threat Landscape: Organizations must assume that AI agents are actively scanning for and exploiting zero-days in real-time. Security strategies should evolve from periodic auditing to continuous, automated vulnerability management and immediate patch deployment for critical services.
- Supply Chain and Dependency Vigilance: The reliance on third-party modules like RedisBloom introduces additional attack surfaces. Teams should audit all enabled modules and restrict command permissions (e.g.,
RESTORE) to minimize the blast radius of potential memory corruption exploits. - Verification Gap: The discrepancy between self-reported AI findings and official CVE assignment highlights the need for independent verification mechanisms. Security teams should monitor community disclosures and vendor updates closely rather than relying solely on formal CVE databases for immediate risk assessment.
Disclaimer: The above content is generated by AI and is for reference only.