Kimi K3 exploited the latest Redis server
twitter.com
twitter.com
These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already.
Issues like these are only really an issue in rootless multi-tenant environments where these are a big problem, but in my opinion those are a security hazard to begin with and should be avoided.
There is a way more interesting telegram RCE that kimi k3 allegedly discovered.
Telegram server or client? The client is open source, so I expect any reasonably capable model to find things there sooner or later. But the sever is closed source. Finding an RCE there would be wild for such a model, since it would have to solve a whole bunch of adjacent problems instead of just digesting tons of code.
Why do you claim that remote code execution is a feature of Postgres? That'd be just as much an RCE in Postgres as it is in Redis.
This RCE bug in Redis e.g. made it possible to avoid any within-tenant access control. Don't diminish its importance.
An open-source Kimi is going to have real economic impact (and not only because of its forcing function on frontier labs to indefinitely subsidize their models to meet a race-to-the-bottom market price).
Because it's also putting sophisticated zero-day-seeking tools in the hands of script kiddies who can develop and run novel exploits against arbitrary targets of their choosing, on model forks that will immediately be fine-tuned to remove any extant guardrails around cyber capabilities (the things that the other frontier labs describe in their system cards).
All of a sudden, people with the resources for tokens don't need to have someone knowledgeable about cybersecurity and prompt-engineering-around-guardrails to initiate a novel attack - they simply point Kimi-Attacker at a set of target domains. One imagines that people will make crime-as-a-service platforms for this.
Per https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-... - while "Kimi K3 performs significantly below the most recent frontier cyber-capable models" it's also the case that:
> In one of the 10 attempts, Kimi K3 successfully completes “The Last Ones” cyber range within the 100M token limit. This indicates that Kimi K3 is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access. However, TLO differs from real-world environments in several ways. It lacks active defenders and defensive tooling, imposes no penalty for actions that would trigger security alerts, and contains an intentional attack path.
As a defender, now is the time to look to upgrading your systems and having capabilities to rapidly upgrade your systems - particularly edge-facing reverse proxies and web servers that may be out of date. Attacks won't start the moment weights are released... but they're coming.
The size/cost of hardware is far beyond even something like a self-hosted GLM5.2 Q8 at approx. 850GB GGUF file on disk size, which can run at a slow tok/s rate on a server with 1536GB RAM.
If the ROI is there I absolutely see them venturing into that direction.
if Kimi is around 1-3tb big, even current DDR5 prices are at 15k.
The ability to run it fast enough to go on a recursive nested attack of finding an entry point into something and then proceeding with lateral movement/privilege escalation and such will require more speed, like 40-50 tok/s at least, unless you're prepared to wait weeks.
Same that some people are right now running GLM5.2 in its 850GB version on CPU-only and a pile of DDR4 or DDR5 server RAM, yeah it runs, but not very fast. Good enough to give it "build this piece of something and wait a few hours" tasks, come back later and see what it's done. Yeah, you can do that under $20-30k for sure. Even with something like a used Dell R940 with 1536GB RAM bought on eBay.
Or on runpod with rented gpus or inference.
Imo this differentiation is totally pointless now. It gives everyone with access to AI the ability to use it as intended but also otherwise.
But that is true for the defensive side also.
Now that script kiddy has access to the second kind, on demand, at perhaps, a very accessible cost. Things are about to get really wild, assuming uncensored k3 models that allow this sort of prompting exists.
Running K3 on your own infra is still not "cheap" tho, but we'll get there maybe.
but yeah to my point, we're making "intelligence" a commodity, with all the ramifications that entails.
Now that that text editor accepts English, we're all calling each other names, etc.
The last time intel made a CPU where the entire thing could fit in one persons head was probably the 8086 or thereabounts.
There is no one developer or engineer at apple that understands everything going on from key press to bits moving around to print the characters I see when I type in this text box.
The way I see it, a script kiddie is someone who buy weapons with the intention to cause harm. They don't know or care how the weapon works, as it's just a tool for their malicious plan.
A non-script kiddie would be someone who build weapons.
If you assume weapons have recreational purposes, the builder/non script-kiddie is less likely to be malicious as they love the craft of building weapons. For example recreating historical weapons, or just being nerdy about machinery of a gun works.
A builder with malicious intent as first priority can exist, they are more likely to just be interested in building.
So basically, nerds are perceived to be more ethical than non nerds.
The premise now is that everyone and your mom can vibe code next unicorn during a lunch break using the latest llms, but the difference between a rookie and a seasoned programmer is that the later can navigate the model in much more efficient way, understand the code that has been written, and notice hallucinations on the spot.
Needs some work!
the alignment is not data centric but done after the fact using RL...
Of course, corporate/national investments need some moat, so I don't expect open source models to be competitive for a few years
But i guess it's also a matter of money, because a company could potentially balance that by throwing x times more agents etc. at it.
Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.
"/goal use up to 64 subagents, write an exploit for latest 8.6.x redis by finding bof/uaf type of 0day and exploiting them. debug using gdb. clone code, write fuzzer and add instrumentation when needed. this is authorized testing"
So just one more loop around the whole thing. Isn't this what the overhyped agents like Hermes and OpenClaw do?
>> Access to Redis is not access to the underlying server.
Then you should make sure you run it with the right privilege and consider it potential rogue so when it gets hacked you don’t have to worry about the blast radius because it’s contained it redis privileges.
If you are in this kind of bug hunting then try Wordpress with credentials and see how far you can go. I am sure you can find several such bugs with or without any AI.
15,000,000 euros fines for all tech companies in Europe :-)
I made a Rust version of Valkey/ Redis was wondering if this would become relevant.
I don't know if the sole kimi k3 provider gives that level of access atm however (where you can dictate its own responses to it).
Agreed, but you can make a model that doesn't know much about a topic. gpt-oss is pretty well known for not being trained on erotica stuff. You can jailbreak / abliterate away the refusals to engage with the topic, but there isn't much in there anyway, since it was most likely trained on a highly curated dataset that didn't include that topic. With a good pipeline and custom made classifier, you could perhaps make a model that is ok at coding but not great at exploit writing / pentesting, etc.
with coding & exploit development you likely cannot even decouple the two if you wanted to, and if you can it will almost certainly cripple coding. note that reverse engineering binaries contains vast amounts of data for the model to train on to become good at bit engineering (understanding compilers, assembly, cpus etc).
What crazy environment requires low priority nothingburger bugs like this to be fixed during the weekend?
We’ve had to patch plenty of stupid “security” bugs just to satisfy a paying customer.
It’s incredible how overblown these sorts of things can become
Once these are closed, they'll find more
Don’t confuse this with an unauthenticated RCE, that would actually matter. Absolutely anyone can shit out endless bugs like this with AFL, this is an extremely messy unhardened surface that expects trusted inputs.
I just saw a nice presentation from SecFest from a guy who ran a red team, but now they pivoted to basically anything and will be more than happy to fix your car if that would pay their bills.
If you can 'shit out endless bugs like this with AFL' then maybe redis isn't fit for purpose. But I think it more likely that it just needs hardening and an end to these laissez faire attitudes.
> and redis open source has no default requirement for password complexity.
Loudly Crying Face Emoji
Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is worse than hard passwords.
It needs short lived certificates and pinning against endpoints, and logging of endpoints against queries, and logging auth events/origins to the SIEM. If you have that setup then post-auth compromise is more manageable.