Kimi K3 Agents Reportedly Found 19 Redis Zero-Days

Agents built on Kimi K3 surfaced 19 Redis zero-days in about 90 minutes, according to security researcher Chaofan Shou. A separate run turned one bug into a working remote code execution exploit against Redis 8.8.0 in 27 minutes, one of four stock builds affected.

The findings hit stock builds of 6.2.22, 7.4.9, 8.6.4 and 8.8.0. The chain pairs a stream consumer-group shared-NACK double-free, tracked as CVE-2026-25589, with a heap overflow in the bundled RedisBloom TDigest module.

Redis already shipped fixes across seven release lines, from 6.2.23 up through 8.8.1. Yes, but neither Redis's maintainers nor Moonshot, the lab behind Kimi K3, have confirmed agents actually found the bugs. The Hacker News report attributes the 90-minute and 27-minute figures to Shou, not to Redis or Moonshot directly.

If you're running an affected build, patch to 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5 or 8.8.1. The timing claim can wait for confirmation. The vulnerability can't.