Two things happened in quick succession that look like they contradict each other. On July 23, a research group called Bera Buddies published work claiming their Kimi K3 agents found 19 Redis zero-days in about 90 minutes, with one working exploit ready in 27 minutes. Redis confirmed the vulnerabilities and shipped patches across six branches the same day. Then on July 25, the UK AI Safety Institute and its U.S. counterpart CAISI released a preliminary assessment of Kimi K3’s cyber capabilities concluding the model “performs significantly below the most recent frontier cyber-capable models” — specifically, it achieved arbitrary code execution on 0 of 41 ExploitBench tasks, while frontier models averaged around 65%.
Both are accurate. The apparent contradiction resolves once you look at what each task actually requires.
The Bera Buddies work gave Kimi K3 a specific, constrained goal: find memory corruption — buffer overflows and use-after-free vulnerabilities — in Redis. That is a directed search in a known codebase, aimed at a well-defined class of bugs. The agent found two real vulnerability chains. The first is CVE-2026-25589, a double-free in Redis stream consumer groups: the shared-NACK path can free the same heap chunk twice, giving an authenticated client a reliable primitive for code execution. The second is a heap overflow in the RedisBloom module’s TDigest loader, where the code trusts an attacker-controlled capacity field to determine how much data to load — producing a write primitive that reaches code execution. Both require authenticated access via the RESTORE command. Redis confirmed them and patched.
ExploitBench is a different kind of problem. Its 41 tasks are built around V8 engine vulnerabilities — the sort of CTF-style challenge where you receive a binary, identify a subtle memory safety issue in a complex JIT compiler, then chain primitives into a full code-execution exploit without a map of where to look. V8 exploitation is among the harder categories in practical security research; bugs are typically subtle type confusion or JIT compilation artifacts, and the primitives are rarely clean. Critically, the task is open-ended: the model must work from the challenge description outward, without a predefined bug class to scan for.
Kimi K3 made it partway through about 32% of ExploitBench tasks but closed the loop into full ACE on none. That 32% partial completion rate is not nothing — it means the model is finding relevant paths and making progress. But it is well below the ~65% ACE rate of frontier models, and it does not reach the finish line. The TLO network attack simulation shows a similar pattern: Kimi K3 averaged step 17 of 32 and completed the full sequence once in ten runs, while frontier models averaged 28.5 steps. It can execute multi-step attack sequences; it runs out on harder configurations that require more lateral reasoning.
The picture that emerges is fairly coherent. Kimi K3 is a capable agent for directed vulnerability discovery — give it a codebase and a target bug class and it finds real bugs in real software. It is not a capable autonomous exploitation engine for open-ended challenges on unfamiliar targets. This distinction matters more than it might seem: finding that a use-after-free exists in a known module is a different skill from turning an unknown bug in a JIT compiler into a working RCE on a fresh target. Benchmarks designed for the latter don’t say much about the former, and vice versa.
There is an awkward backdrop here. The White House distillation accusations against Moonshot, covered earlier this week, allege that Kimi K3 was trained on Anthropic’s outputs at scale. The AISI assessment is independent of those allegations, but the combination creates a notable gap: a model accused of training on frontier data that nonetheless lands significantly below frontier on capability benchmarks. Whether the V8-heavy ExploitBench is simply the wrong evaluation suite for K3’s actual capabilities, or whether there is something more structural going on, will be worth watching when the full technical report arrives alongside the July 27 weight release.
The Redis patches are out; the vulnerabilities are fixed. What the two-day gap between Bera Buddies and AISI really illuminates is that “AI found zero-days” has specific meaning: productive when the task is scoped and the codebase is accessible, considerably harder when the challenge is open-ended and the target is novel.