The 'RufRoot' Flaw: Why Patching Alone Won't Fix This AI Security Hole

Key points

• Researchers at Noma Security found CVE-2026-59726 in Ruflo, an open-source platform businesses use to run automated AI agents, and gave it the maximum possible severity score of 10 out of 10.
• The flaw let anyone on the internet walk into a Ruflo system without a username or password, take full control, steal stored API keys, and read every conversation the platform had ever handled.
• Attackers could also quietly rewrite the AI's memory, bending how it behaves toward future users, even after the attackers had left and the software was patched.
• Ruflo released a fix within 24 hours of being told about the flaw on 30 June 2025, switching the platform to a locked-down default that requires authentication.
• Noma Labs advises that any organisation running Ruflo should treat its AI credentials as already stolen, rotate them immediately, and rebuild the system from scratch.

What happened?

Ruflo, formerly known as Claude Flow, is a platform companies use to host AI agent swarms, meaning groups of automated AI programs that carry out tasks on a business's behalf. Researchers at Noma Security's research division, Noma Labs, found that Ruflo left a door wide open by default.

The door in question was something called an MCP bridge, short for model context protocol bridge, which is essentially a communication channel the platform uses to receive instructions. That channel required no password. One ordinary web request was enough to gain full remote code execution, meaning an attacker could run any command they liked inside the company's Ruflo system from anywhere on the internet.

Once inside, they could grab the API keys (the digital passwords Ruflo uses to talk to AI services such as those from Anthropic or OpenAI) and read every conversation the platform had stored. The researchers also demonstrated they could spin up a swarm of AI agents to carry out further attacks.

Why can't you just patch this and move on?

The patch is real and necessary, but it may not be enough on its own.

The most unsettling part of Noma Labs' findings is what they called memory tampering. By planting hidden instructions inside the platform's persistent memory (the record of context and instructions the AI carries forward to shape future responses), attackers could steer how the AI behaves toward later users, long after the attackers themselves had gone. A patched system that was previously infected could still be running with corrupted reasoning.

This is distinct from a traditional software bug. Patching the authentication gap stops new attackers getting in. It does not undo instructions already buried in the AI's memory.

What should organisations using Ruflo do right now?

Noma Labs is clear: assume the worst. If your organisation ran a Ruflo deployment that was publicly accessible, you should treat every API key it held as already stolen and replace them all. Audit the platform's stored AI memory for any instructions that should not be there. Then rebuild the containers (the self-contained software environments Ruflo runs in) from a clean image rather than trusting the existing installation.

More broadly, security researchers quoted by Dark Reading say this incident points to a new category of risk. AI agent platforms concentrate enormous power in one place: credentials, stored conversations, the ability to run commands, and a memory the AI trusts. A missing password check on that kind of system is an old mistake with very new consequences.