An autonomous AI-driven research tool developed by Theori has identified a critical use-after-free (UAF) vulnerability in Redis, designated as CVE-2026-23479. The flaw resides within the Redis blocking-client code and allows for remote code execution (RCE) and arbitrary OS command execution by an authenticated user. This vulnerability persisted in all stable branches from Redis 7.2.0 through the May 5, 2026, patch release, effectively evading both human security researchers and traditional automated testing methodologies for approximately two years. The discovery marks a significant escalation in the capability of autonomous agents to perform deep-code auditing and identify complex logic errors in production-grade software.

• Research Overview: Autonomous AI Discovery

  • Developed by Theori for large-scale, autonomous codebase auditing.
  • Identified complex logic errors bypassed by human researchers and traditional fuzzing tools.
  • Represents a paradigm shift toward autonomous, deep-code vulnerability research.

• Vulnerability Mechanics: CVE-2026-23479

  • Type: Use-after-free (UAF) vulnerability.
  • Affected Component: Located specifically within the Redis blocking-client code.
  • Attack Vector: Requires authenticated user access to trigger execution.
  • Exploitation Result: Remote Code Execution (RCE) and arbitrary OS command execution.

• Impact and Exposure: Two-Year Window

  • Affected Versions: Redis 7.2.0 and all subsequent stable branches.
  • Duration: Approximately two years of exposure across the ecosystem.
  • Remediation: Critical patch released by the Redis Security Team on May 5, 2026.

• Industry Implications: The Evolving Threat Landscape

  • Demonstrates high efficacy of AI agents in performing production-grade software analysis.
  • Signals an increased zero-day discovery rate for software maintainers.
  • Suggests traditional automated testing must integrate AI to remain effective.

• Conclusion: Defensive Mandates

  • Organizations must immediately verify Redis versions and apply the May 2026 patch.
  • Security teams should prepare for an era of AI-accelerated vulnerability discovery.