A maximum-severity vulnerability in the open-source AI agent platform Ruflo, known as the RufRoot vulnerability, has raised fresh concerns about the security of enterprise agent deployments.
The flaw allowed attackers to enter the orchestration framework without authentication, execute malicious activities and potentially leave AI agents behaviorally compromised even after administrators installed the software patch.
Researchers at Noma Security’s Noma Labs discovered the vulnerability, tracked as CVE-2026-59726, in Ruflo, the platform formerly known as Claude Flow. Ruflo hosts and coordinates AI agent swarms built around tools such as OpenAI Codex and Anthropic Claude Code.
The vulnerability received a CVSS score of 10.0, the highest possible severity rating. According to Noma Labs, an attacker could exploit the platform without logging in.
That is already serious. The possibility that manipulated agent behavior could survive the initial remediation makes the incident harder to contain.
Ruflo’s MCP Bridge Was Left Exposed
Ruflo acts as an orchestration layer for multi-agent AI systems. Developers can use it to coordinate agent swarms, connect models to external tools, preserve information between sessions and automate tasks across coding and enterprise environments.
At the centre of the vulnerability was Ruflo’s Model Context Protocol, or MCP, Bridge.
The bridge operated as an Express.js server that received requests from AI agents and passed them to tools inside the underlying environment. Noma Security researchers found that it exposed hundreds of internal tools through HTTP without requiring proper authentication.
No login. No API token. Very little standing between an attacker and a powerful AI control layer.
One of the exposed tools could reportedly execute arbitrary shell commands. An attacker who reached the MCP Bridge could send a specially prepared request and gain command execution inside the container.
One Request Could Hand Over the AI Environment
Remote code execution is dangerous in almost any application. RufRoot created a broader problem because the vulnerable service sat at the centre of a coordinated network of AI agents.
An attacker could potentially access provider API keys, inspect stored conversations, change agent configurations and interfere with the tools available to autonomous workflows.
The impact would depend on how an organisation configured Ruflo. Some agents might have access to source code. Others could interact with internal documents, cloud services, databases or business applications.
Compromising the orchestration framework could therefore give an attacker influence over several agents at once. There would be no need to breach each agent separately when the bridge already controlled how they communicated and acted.
Black Duck Warns That Patching Alone May Not Be Enough
Commenting on the RufRoot vulnerability, Vineeta Sangaraju, AI Research Engineer at Black Duck, said:
“A CVSS 10 authentication bypass in an open source AI orchestration platform is a stark reminder that as enterprises move fast to adopt agentic AI infrastructure, the security fundamentals of access control, authentication, least privilege, etc. remain non-negotiable.
The most concerning detail here is not the unauthenticated access itself, but the apparent persistence of behavioural compromise in patched agents. This signals a class of risk unique to AI systems, where exploitation can alter model behavior in ways that potentially don’t revert with a software update, not completely at least.
Organisations running agentic frameworks should treat remediation as a two-part problem: patching the vulnerability and auditing agent state, outputs, and any downstream actions taken during the exposure window.
The broader question enterprises should be asking is whether their AI deployment pipelines are subject to the same security review processes such as dependency audits, access controls, runtime monitoring etc. that they would normally apply to any critical production infrastructure. Open source AI tooling moves quickly; the security posture around it needs to keep pace”.
Her warning points to an uncomfortable weakness in conventional vulnerability response.
Installing a patch may close the original access point, but it may not remove malicious instructions, poisoned memory or compromised outputs produced while the platform remained exposed.
That leaves security teams with a larger investigation than a normal software update would require.
Memory Poisoning Made RufRoot Harder to Remove
Ruflo supports persistent memory, allowing agents to store information and retrieve it during future tasks.
Researchers found that an attacker could interfere with this memory and insert malicious instructions or misleading information into the agent’s stored context.
That changes the incident-response equation.
An organisation could update Ruflo, restart the affected services and assume the vulnerability had been resolved. The agents, however, might continue using information planted before the patch.
The infection moves from the application into the agent’s working memory.
Traditional remediation often focuses on replacing altered files, rebuilding systems and rotating credentials. Agentic AI environments may require an additional investigation into what the agents remember, which instructions they retained and whether their later decisions can still be trusted.
Remediation Requires More Than Installing an Update
Sangaraju’s comments suggest that organisations should approach the RufRoot flaw as a two-stage security problem.
The first stage is straightforward: install the available patch and restrict access to the exposed MCP Bridge.
The second is less tidy.
Security teams may need to audit agent memory, inspect generated outputs, review tool calls and determine whether any downstream systems were changed while the vulnerability remained open.
That could include checking source-code repositories, cloud resources, internal documents, databases and third-party services connected to Ruflo.
Credentials accessible to the platform should also be rotated. Logs need scrutiny. Suspicious agent actions cannot be dismissed simply because the underlying software now carries a newer version number.
AI Deployment Pipelines Need Traditional Security Reviews
The RufRoot incident also raises a broader question about how enterprises assess AI infrastructure before deployment.
Agentic systems often arrive through experimental teams, developer sandboxes or open-source projects moving at a relentless pace. They may later become part of critical workflows without going through the same review process as ordinary production software.
That is where the risk widens.
AI deployment pipelines still need dependency audits, authentication controls, runtime monitoring and restrictions on network access. Agent permissions should remain narrow. Sensitive tools should not sit behind publicly accessible interfaces.
The technology may be new. The security fundamentals are not.
Default Docker Settings Increased the Risk
The vulnerability affected Ruflo deployments using an earlier default Docker Compose configuration that exposed the MCP Bridge beyond the application’s internal network.
Some organisations may therefore have deployed the platform without realising that one of its most powerful interfaces was reachable from outside the intended environment.
Default settings matter because developers frequently use them during testing and later carry similar configurations into production.
A service intended for local communication can become publicly accessible after a change to cloud networking, firewall policies or container settings.
With RufRoot, that mistake exposed an interface capable of managing autonomous agents and issuing system commands.
Ruflo Released a Fix in Version 3.16.3
Ruflo addressed the vulnerability in version 3.16.3.
The updated configuration restricts access to the MCP Bridge by default and makes external exposure an explicit choice. Authentication is also required when operators intentionally make the service available outside its internal environment.
Updating should be the first response, but it should not be the last.
Organisations that operated an exposed Ruflo deployment should determine whether the affected port was accessible from untrusted networks. They should also inspect application and container logs, rotate connected credentials and review the platform’s persistent memory for suspicious entries.
Any system that Ruflo agents could access may also require examination.
AI Agent Security Cannot Stop at the Model
Most conversations about AI security still focus on model safeguards, prompt injection and harmful responses.
RufRoot sits beneath that layer.
The vulnerability involved the infrastructure connecting AI agents to memory, tools and operating-system functions. The model itself did not need to fail. The surrounding platform gave attackers access to the capabilities the model could use.
Agent platforms combine systems that organisations once managed separately: APIs, containers, databases, memory stores, chat interfaces and automated decision-making.
Every connection adds another trust boundary.
Tools need authentication. Agent permissions should remain narrow. Sensitive services require network isolation. Persistent memory needs integrity checks and monitoring.
Without those controls, an agent swarm can become a force multiplier for an attacker.
RufRoot Is a Warning for Enterprise AI Adoption
RufRoot was fixed quickly, but the architecture behind the vulnerability is not limited to one platform.
Businesses are adopting agents that can write code, retrieve files, operate browsers, call internal applications and coordinate with other automated systems.
Those functions are useful precisely because they give software the ability to act.
Attackers see the same opportunity.
Rather than targeting a single chatbot, they can look for exposed MCP servers, weakly protected gateways and orchestration tools positioned between AI models and enterprise infrastructure.
Compromising that middle layer could provide access to several agents, data sources and business systems in one move.
The lesson is straightforward. AI agents are no longer just conversational tools. Once connected to real infrastructure, they become privileged software operators.
Enterprises need to secure them accordingly.
