TheModelDesk

Security researcher Chaofan Shou reported on X that he used Kimi K3, the AI model from Chinese startup Moonshot AI, to discover 19 zero-day vulnerabilities in Redis 8.8.0 — the then-current version of the open-source in-memory database — in just 90 minutes. Kimi K3 also generated proof-of-concept exploit code, which Shou published in a GitHub repository (berabuddies/redis-poc).

The Redis project responded with patched releases on Thursday night: versions 8.8.1, 8.6.5, 8.4.5, 8.2.8, 7.4.10, 7.2.15 and 6.2.23 fix at least some of the reported flaws. The maintainers thereby confirmed the vulnerabilities, for instance the exploit dubbed "P88W", which was addressed via a pull request in the RedisBloom module.

Severity ratings and CVE entries are still pending. However, because working PoC code is publicly available, attackers can exploit the flaws more easily. Administrators are advised to update to the patched release for their deployed branch as soon as possible; source code is available and Linux distributions are expected to ship updates shortly.

The case demonstrates that Kimi K3 — positioned as a competitor to leading models from OpenAI and Anthropic — can genuinely find vulnerabilities and produce exploit code, a capability previously associated with tools like Anthropic's Mythos or Fable and OpenAI's Codex Security. Moonshot AI has reportedly paused new subscriptions due to GPU shortages amid surging demand, and this result is likely to fuel further interest.