A top-severity flaw in a popular AI agent tool let anyone run commands with a single request
Ruflo left 233 tools exposed through an unauthenticated MCP bridge. The bug scored the maximum 10.0 and was patched in version 3.16.3.
Security researchers at Noma Labs have disclosed a maximum-severity flaw in Ruflo, a widely used open-source tool for running swarms of AI agents. The bug, tracked as CVE-2026-59726 and nicknamed RufRoot, scores 10.0 out of 10 on the standard severity scale and affects every version before 3.16.3.
The problem was a door left open. Ruflo exposed 233 tools, including shell command execution, database operations, agent management and memory storage, through an MCP bridge that required no login and was reachable over the network by default. MCP, the Model Context Protocol, is the increasingly common standard that lets an AI agent talk to outside tools. In this case a single HTTP request was enough for full remote code execution, meaning an attacker could run whatever they wanted on the machine. From there, the researchers demonstrated stealing API keys and stored conversations, spawning attacker-controlled agent swarms, poisoning the memory that shapes future agent output, installing persistent backdoors, and wiping shell history to cover the tracks. Noma Labs reported the issue on June 30 and Ruflo shipped a fix within 24 hours by locking the bridge down by default.
What is behind it
Agent tooling is moving faster than agent security, and this bug is a textbook example of why. The convenience that makes these tools pleasant to use, everything reachable, nothing in the way, no authentication to fumble with on your own laptop, becomes a liability the moment the same defaults ship to people running on a server or a shared network. Note the second-order damage here too: it is not only that an attacker could run code, it is that they could poison an agent’s stored memory so it kept producing attacker-shaped output long after the intrusion. Traditional security thinking does not have a good category for that yet.
What this means for you: If you have never installed an agent framework, nothing here affects you. If you have, and especially if you run Ruflo, update to 3.16.3 or later today. Beyond this one tool, two habits are worth adopting. First, assume any local AI tool binds to your network unless you have checked otherwise, and check. Second, give agents credentials scoped to what they actually need rather than your main API keys, so a compromise costs you one narrow key instead of everything. Worth knowing before you get excited about agent swarms: the tooling is genuinely useful and genuinely young.
Sources
Source: https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html
An OpenAI researcher quit after eight months, betting that better data matters more than bigger models
Andrew Ho left OpenAI to build specialised training datasets and expects labs to spend over $100 billion on data collection. A Cambridge researcher sees the same pattern from the outside.
