A swarm of 32 AI agents based on Moonshot AI's Kimi K3 model (2.8T parameters, MoE) discovered several RCE vulnerabilities in Redis, including an exploit for version 8.8.0 assembled in just 27 minutes. Researchers also reported identifying a potential attack chain targeting Telegram Desktop and iOS via corrupted video files, which could lead to zero-click code execution.
What Happened
A group of 32 autonomous agents utilizing the Mixture-of-Experts (MoE) architecture of the Kimi K3 model successfully identified critical Remote Code Execution (RCE) vulnerabilities in Redis. Specifically, within 27 minutes, the agents were able to not only find a flaw but also synthesize a ready-to-use working exploit for version 8.8.0. Additionally, attack vectors through media content were discovered that could compromise Telegram Desktop and iOS.
Context
This event marks a transition from using AI as a passive code analysis assistant to the emergence of autonomous 'offensive AI' systems. The use of multi-agent structures allows for the efficient distribution of tasks among individual agents for searching, verifying, and subsequently assembling full-scale attack tools, radically reducing the time from vulnerability discovery to exploitation.
Why It Matters for the Industry
For the AI industry and the cybersecurity sector, this signifies a sharp shift in the landscape: attacks are moving from the manual discovery stage to the automated execution stage. Developers need to rethink defense strategies, implement countermeasures against automated agent swarms, and prepare for an arms race between autonomous attacking and defensive AI systems.
Why It Matters for Users
Regular users and system administrators should immediately check Redis configurations and update software to the latest versions, as the barrier to entry for conducting complex attacks is now minimal. Particular attention should be paid to the security of messaging apps and mobile OSs, given the identified exploitation possibilities via video files.
What Is Not Yet Known / Limitations
There is ongoing debate within the expert community regarding the robustness of such technologies: while some see them as a tool for automated pentesting, others express skepticism regarding their long-term stability and predictability in real-world conditions.
Sources
Author
Look at AI, Editorial Team