Chinese AI agents from the Kimi K3 platform autonomously discovered zero-day vulnerabilities in Redis and developed functional remote code execution exploits, marking a significant milestone in autonomous AI-driven vulnerability research.
Researchers who conducted the experiment gave the Kimi K3 agents access to source code analysis tools and instructed them to find security flaws in the popular in-memory data store. The AI agents independently identified previously unknown vulnerabilities, analyzed their exploitability, and wrote working proof-of-concept code that could achieve remote code execution against vulnerable Redis instances.
The achievement is notable because the Kimi K3 agents performed the entire workflow without human intervention: from static code analysis and vulnerability identification through to exploit development and verification. Traditional vulnerability research requires significant manual effort from skilled security engineers, often taking weeks or months per vulnerability. The Kimi K3 agents completed the Redis analysis in a fraction of that time.
Redis has been notified of the findings and is preparing patches. Organizations running Redis should monitor for security updates and apply them promptly once released. The research underscores the accelerating capability of AI systems in offensive security contexts, where autonomous agents can now match human researchers in discovering and weaponizing software vulnerabilities at machine speed.
