Ruflo
An open-source tool for running coordinated swarms of AI agents, hit by a maximum-severity security flaw in July 2026.
Ruflo is an open-source meta-harness, meaning software that sits above coding agents like Claude Code and OpenAI Codex and coordinates several of them working together on the same job. It became popular quickly among developers who wanted more than one agent on a task at a time.
In July 2026 researchers at Noma Labs disclosed a flaw in it scoring the maximum 10.0 severity rating, because Ruflo exposed 233 tools including shell access through an MCP bridge that needed no login and was open to the network by default. A single request was enough to take over the machine. The fix landed in version 3.16.3 within a day of being reported, which is a good outcome, but the episode is a fair illustration of how young agent tooling still is.