Kimi K3 Replicates Redis High-Risk Vulnerability in 27 Minutes

KuCoinFlash

Release Time:

Summary

A MetaEra report shows that Kimi K3 replicated a known Redis vulnerability in 27 minutes using 32 agents. Researcher Chaofan Shou confirmed that the model generated functional exploit code and a complete attack script. The vulnerability had already been patched in Redis 8.8.0. Effective risk management is essential for developers using similar tools. The test underscores the importance of balancing innovation with the risk-to-reward ratio in security practices.

ME AI message, according to monitoring by Beating, security researcher Chaofan Shou, who previously discovered the accidental leak of Claude Code’s source code, said he tasked Kimi K3 with conducting authorized security testing on the older Redis 8.6.x version. The model activated 32 agents in total and identified a vulnerability within just 27 minutes, then generated a functional exploit program. His prompt allowed the model to invoke up to 64 sub-agents. Tasks included cloning the Redis source code and searching for vulnerabilities such as buffer overflows and use-after-free. The model could also autonomously write fuzzing tools, embed monitoring code, and debug using GDB. Shou noted that Kimi K3 is the first large model that “has both the capability and willingness to write exploit code.” By “willingness,” he means the model did not outright refuse due to safety restrictions but proceeded under the clear understanding that this was an authorized test. Kimi also produced a complete exploit code capable of executing specified commands on the server running Redis. The public PoC has been verified on Redis versions 6.2.22, 7.4.9, and 8.6.4. However, this is not a newly discovered 0day vulnerability—Redis had already patched the same attack vector in version 8.8.0. (Source: BlockBeats)

Source:Show original

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.