The 'RufRoot' Flaw: Why Patching Alone Won't Fix This AI Security Hole

Key points

• Researchers at Noma Security found CVE-2026-59726 in Ruflo, an open-source platform businesses use to run automated AI agents, and gave it the maximum possible severity score of 10 out of 10.
• The flaw let anyone on the internet walk into a Ruflo system without a username or password, take full control, steal stored API keys, and read every conversation the platform had ever handled.
• Attackers could quietly rewrite the AI's memory, bending how it behaves toward future users even after they'd left.
• Ruflo released a fix within 24 hours of being told about the flaw on 30 June 2025, switching the platform to a locked-down default that requires authentication.
• Noma Labs advises that any organisation running Ruflo should treat its AI credentials as compromised, rotate them, and rebuild the system from scratch.

What happened?

Ruflo, formerly known as Claude Flow, is a platform companies use to host AI agent swarms: groups of automated AI programs that carry out tasks on a business's behalf. Researchers at Noma Security's research division, Noma Labs, found that Ruflo left a door wide open by default.

That door was an MCP bridge, short for model context protocol bridge, a communication channel the platform uses to receive instructions. It required no password. One ordinary web request was enough to gain full remote code execution, meaning an attacker could run any command they liked inside a company's Ruflo system from anywhere on the internet.

Once inside, they could grab API keys (the digital passwords Ruflo uses to talk to AI services from providers including Anthropic and OpenAI) and read every stored conversation. Noma Labs also showed they could spin up a swarm of AI agents to carry out further attacks. We first reported the authentication gap on 29 July 2026 in "Critical Flaw in Ruflo AI Harness Lets Anyone Run Commands on Your Server".

Why can't you just patch this and move on?

The patch is necessary. It isn't sufficient.

Noma Labs found they could plant hidden instructions inside the platform's persistent memory, the record of context the AI carries forward to shape future responses. Those instructions steer how the AI behaves toward later users long after the attacker has gone. A patched system that was previously compromised could still be running on corrupted reasoning.

This isn't a traditional software bug. Closing the authentication gap stops new attackers getting in; it doesn't undo instructions already buried in memory. "This is not exploiting software flaws, it is memory poisoning," John Gallagher, vice president at Viakoo, told Dark Reading.

What should organisations using Ruflo do right now?

Assume the worst. If your organisation ran a publicly accessible Ruflo deployment, treat every API key it held as compromised and replace them. Audit stored AI memory for instructions that shouldn't be there. Rebuild the containers (self-contained software environments Ruflo runs in) from a clean image rather than trusting the existing installation.

The harder lesson is structural. Johan Edholm, security engineer and co-founder of Detectify, told Dark Reading that the authentication failure itself is old news: "one of the oldest failure patterns on the Internet." What's changed is what sits behind that door. An AI agent platform concentrates provider credentials, stored conversations, shell access, and a persistent memory the AI trusts, all in one place. Missing a password check on that kind of system is a familiar mistake with consequences that didn't exist two years ago. Watch whether other agent orchestration platforms audit their own default network exposure before a researcher has to do it for them.