Is this exploit pre-authentication?

No. Every chain Bera Buddies published requires an authenticated Redis client with access to the RESTORE command, and the Streams paths additionally need EVAL and XGROUP. The findings matter because a compromised low-privilege credential can now escalate to code execution, not because an internet-exposed Redis is instantly ownable.

Which Redis versions should I upgrade to?

Move off 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Redis shipped seven patched builds on July 23, 2026: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1. The stream-RESTORE double-free and the RedisBloom TDigest heap overflow are both addressed.

How autonomous was Kimi K3 really?

Chaofan Shou claims 32 agents produced 19 zero-days in about 90 minutes and a full Redis 8.8.0 exploit chain in 27 minutes, coordinated by Kimi K3 with human prompts limited to 'find memory-corruption bugs'. Those numbers are self-reported and neither Redis nor Moonshot has independently confirmed them.

Where can I read the PoCs?

Bera Buddies published the non-destructive proof-of-concept exploits at github.com/berabuddies/redis-poc, covering the stream consumer-group NACK double-free for 6.2.22, 7.4.9, and 8.6.4, plus the TDigest heap overflow for 8.8.0. The lead CVE is CVE-2026-25589.

Bera Buddies · 2026-07-24 · major

Kimi K3 finds Redis zero-days — 32 agents build authenticated RCE in 27 min

Moonshot's Kimi K3, driven by 32 coordinated agents, found 19 Redis zero-days and produced authenticated remote-code-execution PoCs. Redis shipped patches for seven versions on July 23.

Kimi K3 agents find Redis zero-day vulnerabilities

A 32-agent Kimi K3 run cloned Redis, fuzzed it, debugged crashes in GDB, and shipped an RCE proof of concept.

Key specs

Zero days found	19
Fastest exploit	27 min
Redis versions patched	7

Quick facts

Researcher	Chaofan Shou (Bera Buddies)
Model used	Kimi K3 (Moonshot)
Agents	32 coordinated agents
Redis versions affected	6.2.22, 7.4.9, 8.6.4, 8.8.0
Patched versions	6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1
Access required	Authenticated (RESTORE command)
CVE	CVE-2026-25589

What is it?

Researchers at Bera Buddies used Moonshot's open-weight Kimi K3 model to run an autonomous vulnerability-discovery workflow against Redis. The agents found 19 zero-days and wrote authenticated remote-code-execution exploits for Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Redis pushed seven patched versions on July 23 in response.

How does it work?

Kimi K3 coordinated 32 specialised agents that cloned the Redis source tree, generated fuzzers, instrumented the binary, and used GDB to root-cause crashes. The lead bug is a double-free in stream consumer groups: a crafted RESTORE payload makes two consumers share the same pending-entry record, so freeing one leaves the other holding a dangling pointer. A separate heap overflow lives in the bundled RedisBloom TDigest module.

Why does it matter?

Every RCE chain in the write-up requires an authenticated client with access to the RESTORE command, so this is not a pre-auth internet worm — but it does show a mid-tier open model orchestrating end-to-end 0-day discovery and PoC development in minutes, not weeks. Redis operators should upgrade to a patched build; the same class of AI-agent triage will now be pointed at other C daemons.

Frequently asked questions

Is this exploit pre-authentication?: No. Every chain Bera Buddies published requires an authenticated Redis client with access to the RESTORE command, and the Streams paths additionally need EVAL and XGROUP. The findings matter because a compromised low-privilege credential can now escalate to code execution, not because an internet-exposed Redis is instantly ownable.
Which Redis versions should I upgrade to?: Move off 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Redis shipped seven patched builds on July 23, 2026: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1. The stream-RESTORE double-free and the RedisBloom TDigest heap overflow are both addressed.
How autonomous was Kimi K3 really?: Chaofan Shou claims 32 agents produced 19 zero-days in about 90 minutes and a full Redis 8.8.0 exploit chain in 27 minutes, coordinated by Kimi K3 with human prompts limited to 'find memory-corruption bugs'. Those numbers are self-reported and neither Redis nor Moonshot has independently confirmed them.
Where can I read the PoCs?: Bera Buddies published the non-destructive proof-of-concept exploits at github.com/berabuddies/redis-poc, covering the stream consumer-group NACK double-free for 6.2.22, 7.4.9, and 8.6.4, plus the TDigest heap overflow for 8.8.0. The lead CVE is CVE-2026-25589.

Try it

https://github.com/berabuddies/redis-poc