Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-25 · high
Redis patched seven release lines to fix the bugs, but Moonshot hasn't confirmed AI agents found them first.
Why now: The patch train and the agent-discovery claim surfaced together in coverage dated July 25, with confirmation from Redis or Moonshot still missing.
Agents built on Kimi K3 surfaced 19 Redis zero-days in about 90 minutes, according to security researcher Chaofan Shou. A separate run turned one bug into a working remote code execution exploit against Redis 8.8.0 in 27 minutes, one of four stock builds affected.
The findings hit stock builds of 6.2.22, 7.4.9, 8.6.4 and 8.8.0. The chain pairs a stream consumer-group shared-NACK double-free, tracked as CVE-2026-25589, with a heap overflow in the bundled RedisBloom TDigest module.
Redis already shipped fixes across seven release lines, from 6.2.23 up through 8.8.1. Yes, but neither Redis's maintainers nor Moonshot, the lab behind Kimi K3, have confirmed agents actually found the bugs. The Hacker News report attributes the 90-minute and 27-minute figures to Shou, not to Redis or Moonshot directly.
If you're running an affected build, patch to 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5 or 8.8.1. The timing claim can wait for confirmation. The vulnerability can't.
Each link below shares sources, entities, or timing with this story.
Kimi K3 benchmarked against Fable / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Kimi K3 benchmarked against Fable); both cover Moonshot, Treat; earlier Moonshot coverage from 2026-07-24.
Moonshot AI released Kimi K3 / Shared entities / Earlier coverage
Linked by a graph relationship (Moonshot AI released Kimi K3); both cover Kimi K3, Moonshot; earlier Kimi K3 coverage from 2026-07-20.
Linked by a graph relationship (Moonshot AI released Kimi K3); both cover Moonshot, Treat; earlier Moonshot coverage from 2026-06-16.
Moonshot competes with Anthropic / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Moonshot competes with Anthropic); both cover CVE, RCE, Security, Treat; earlier CVE coverage from 2026-03-23.
Kimi K3 built by Moonshot / Shared entity: Moonshot / Earlier coverage / Tension
Linked by a graph relationship (Kimi K3 built by Moonshot); both cover Moonshot; earlier Moonshot coverage from 2026-04-21.
Moonshot AI released Kimi K3 / Shared entity: Kimi K3 / Earlier coverage
Linked by a graph relationship (Moonshot AI released Kimi K3); both cover Kimi K3; earlier Kimi K3 coverage from 2026-07-21.
Kimi K3 built by Moonshot / Shared entity: Moonshot / Earlier coverage
Linked by a graph relationship (Kimi K3 built by Moonshot); both cover Moonshot; earlier Moonshot coverage from 2026-07-19.
Kimi K3 benchmarked against Intelligence Index / Shared entity: Kimi K3 / Earlier coverage
Linked by a graph relationship (Kimi K3 benchmarked against Intelligence Index); both cover Kimi K3; earlier Kimi K3 coverage from 2026-07-19.