AI agents found Redis zero-days. Patch windows just shrank

The interesting part of this week's Redis story isn't the bugs. It's the clock. A researcher pointed a fleet of AI agents at one of the most-audited open source codebases on earth and, by his own account, had memory-corruption findings in about 90 minutes. Redis shipped seven security releases on July 23. If AI agents can compress vulnerability research from months to an afternoon, the window between "a bug exists" and "someone is using it" gets a lot shorter — and your patch cadence is what has to absorb that.

What actually happened

Security researcher Chaofan Shou said Kimi K3 agents turned up 19 Redis zero-days in roughly 90 minutes and produced a working exploit in 27. Those numbers are self-reported and haven't been independently reproduced, so treat them as a claim, not a measurement. What isn't in dispute: The Hacker News reported that proof-of-concept code went public, and Redis responded across every maintained branch — 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.

Two bug classes are in play: a shared-ownership use-after-free in Streams, and an out-of-bounds write in the RedisBloom TDigest loader. Both run through the RESTORE command, which means an attacker needs to be able to issue commands — authenticated access, or a Redis you left open to the internet. Vulnerable builds included 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Neither new bug class had a CVE or CVSS assigned as of July 24, and no in-the-wild exploitation had been reported.

Worth noting: Redis already patched a related batch in May — CVE-2026-23479 and friends, including a use-after-free rated CVSS 8.8. The July round exists because those fixes weren't complete. Agents are good at finding the thing next to the thing you just fixed.

Why this matters for your business

You probably run Redis. It's under your session store, your job queue, your rate limiter, your cache — usually installed by a framework default years ago and never thought about since. That's the exposure: not Redis itself, but the fact that nobody on your team can name which version is running.

The structural shift is that "obscure enough that nobody will look" has stopped being a defense. Automated bug hunting scales in a way human researchers never did, and it works both directions — defenders and attackers get the same tools. What used to be a six-month gap between disclosure and mass exploitation is compressing toward days.

Two concrete moves. First, know your versions. redis-server --version on every box, including the one inside that Docker Compose file from 2023. Second, close the front door: Redis should never be reachable from the internet, requirepass should be set, and RESTORE is a good candidate for rename-command if nothing in your stack uses it. Both of these week's bug classes need command access to matter.

Sources: The Hacker News, Redis Security Advisory.