Key Takeaways
- Redis released seven security updates on July 23, 2026, after researchers published authenticated RCE exploits for four versions.
- Two distinct exploit paths involve the Streams shared-NACK use-after-free and the RedisBloom TDigest out-of-bounds write.
- Kimi K3 agents reportedly discovered 19 zero-days in 90 minutes, but the claim is self-reported and not fully validated by Redis.
- No CVE records were created for the newly disclosed bugs; existing CVE-2026-25589 covers only the RedisBloom memory corruption.
Kimi K3 AI Agents Uncover Severe Redis Flaws in Hours
Redis shipped seven security releases on July 23, 2026, after researchers demonstrated authenticated remote code execution (RCE) proofs-of-concept against versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The vulnerabilities, discovered using Kimi K3 AI agents, include use-after-free and out-of-bounds write issues that could allow an authenticated attacker to execute arbitrary code via the RESTORE command.
Table of Contents
Technical Analysis: The Two Exploit Paths
The first exploit chain targets Redis Streams via a shared-ownership bug. A corrupt RDB object can make two consumers point to the same pending-entry record, or streamNACK. Removing the first consumer frees the object, leaving the second with a dangling pointer. When the second consumer is removed, a double-free occurs, leading to memory corruption that the PoC exploits for arbitrary memory access and eventually calls system().
The second path sits in the RedisBloom TDigest RDB loader. The loader allocates centroid arrays based on a serialized compression value but trusts a separate attacker-controlled capacity field for the number of nodes. This mismatch causes an out-of-bounds write. The PoC for Redis 8.8.0 leverages this to leak Redis and libc addresses, then poison a hash function so a crafted GET triggers system().
Both chains require the RESTORE command. The Streams chain additionally needs EVAL and XGROUP; the 8.8.0 chain also requires the bundled RedisBloom module. Redis has fixed all versions: 6.2.23, 7.2.15, and 7.4.10 patch the Streams issue, while 8.2.8, 8.4.5, 8.6.5, and 8.8.1 address both the Streams flaw and the RedisBloom/TDigest problems.
Industry Implications: AI-Discovered Vulnerabilities and Response
According to The Hacker News, the Kimi K3 agent’s reported discovery of 19 Redis zero-days in roughly 90 minutes highlights the accelerating role of AI in vulnerability research. These claims remain self-reported, with Redis confirming the specific flaws but not the zero-day count or agent autonomy. Nevertheless, the speed of identification challenges traditional patch cycles.
Notably, neither the shared-NACK nor the TDigest flaws received new CVE identifiers. Redis maps the Streams issue to an incomplete fix family under CVE-2026-25589, which originally covered RedisBloom memory corruption. As of July 24, no NVD record exists for these new bugs, and CISA’s Known Exploited Vulnerabilities catalog shows no entries. This gaps in tracking could delay enterprise patching efforts.
For AI-focused organizations, this case underscores the need for rigorous validation of AI-discovered vulnerabilities and coordination with vendors. The speed of AI-driven disclosure may outpace incident response frameworks, requiring new protocols for handling agent-reported flaws.
Securing the Supply Chain: Actionable Steps Ahead
Redis advises upgrading to the latest fixed release for the deployed branch. As an immediate workaround, revoke RESTORE permissions from accounts that do not strictly require it and block untrusted network access. Restricting RESTORE cuts off both disclosed attack paths. Given the absence of in-the-wild exploitation as of July 24, organizations have a narrow window to patch before adversaries adopt these techniques.
The broader lesson is that AI agents are reshaping vulnerability discovery, compressing timelines from months to minutes. Enterprises must adapt by integrating automated patch management, validating third-party claims, and maintaining tight control over critical database commands like RESTORE. The convergence of AI and security demands a proactive stance, ensuring that the same technology used to find bugs does not outpace the defenses designed to fix them.
Andres SEO Expert helps businesses navigate these fast-changing technical landscapes. If your organization needs to secure its AI pipelines and automate vulnerability response, consider exploring our programmatic SEO AI automation services to streamline security workflows. Connect with Andres to discuss your needs, or visit Andres SEO Expert for more insights on AI-driven performance and security.
Frequently Asked Questions
What specific Redis vulnerabilities did Kimi K3 AI agents discover?
The Kimi K3 agents reportedly uncovered two exploit paths: a use-after-free/double-free bug in Redis Streams (shared-NACK) and an out-of-bounds write in the RedisBloom TDigest RDB loader. Both require the RESTORE command and allow authenticated remote code execution.
Which Redis versions are affected and what are the fixed versions?
Versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0 are vulnerable. Fixed versions are 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1. The Streams issue is patched in 6.2.23, 7.2.15, and 7.4.10; the later versions also fix the RedisBloom/TDigest flaw.
Were CVEs assigned to these newly discovered flaws?
No new CVEs were assigned. Redis maps the Streams issue to an incomplete fix family under CVE-2026-25589 (originally for RedisBloom). As of July 24, no NVD record or CISA KEV entry exists for these specific bugs.
How can organizations mitigate these vulnerabilities immediately?
Redis recommends upgrading to the latest fixed release. As a workaround, revoke RESTORE permissions from accounts that do not need it and block untrusted network access, since RESTORE is required for both attack paths.
What are the industry implications of AI-discovered vulnerabilities like these?
AI agents can discover vulnerabilities in minutes, compressing disclosure timelines and challenging traditional patch cycles. This demands faster incident response, automated patch management, and new protocols for validating AI-reported flaws to prevent exploitation before fixes are deployed.
Do the exploits require authentication?
Yes, both exploit chains require authentication to Redis. The attacker must have access to the RESTORE command and, depending on the chain, also need EVAL and XGROUP (Streams) or the RedisBloom module (8.8.0).
Are there any known in-the-wild attacks exploiting these Redis bugs?
As of July 24, 2026, no in-the-wild exploitation has been reported. However, given the speed of AI-driven discovery, organizations have a narrow window to patch before adversaries adopt these techniques.
