Imagine handing a stranger the keys to your house, your car, and your bank vault, then not bothering to ask for ID because, hey, they seemed nice enough. That's roughly what Ruflo, a wildly popular open-source AI agent platform, was doing to the entire internet until a security firm noticed and gently — okay, urgently — pointed it out.
An Open Door Wearing a "Please Rob Me" Sign
Ruflo is a big deal in the agent-orchestration world — around 67,000 GitHub stars and roughly 10 million downloads, used for spinning up swarms of AI agents that call tools and remember things across sessions. Researchers at Noma Labs found that its MCP Bridge, an Express.js server routing tool calls between agents, exposed 233 different tools over plain HTTP with absolutely no authentication. One of those tools could execute arbitrary shell commands. A single unauthenticated POST request to port 3001 was all it took to get full command execution inside the container — no token, no API key, no header check.
Tracked as CVE-2026-59726 and nicknamed "RufRoot," the flaw earned a perfect CVSS score of 10.0. Noma Labs demonstrated an eight-step attack chain against default AWS deployments that included stealing credentials, hijacking agents, poisoning their persistent memory, stealing conversation history, and dropping a backdoor that survives a restart.
The Part That Should Really Worry You
This isn't a bug in some throwaway script — it's the control plane for autonomous agents that are increasingly trusted with real credentials, real databases, and real infrastructure. When the "front door" to that system has no lock, an attacker doesn't just get data, they get a fleet of obedient AI agents that will keep doing whatever they're told, indefinitely, using your compute and your permissions.
To Ruflo's credit, the maintainer shipped a fix within 24 hours of disclosure — bearer token authentication, binding to localhost by default, terminal access disabled unless explicitly turned on, and required database authentication. But the researchers' warning still lands: even patched, an agent that was compromised before the fix can remain behaviorally tampered with, memory poisoning being the security equivalent of gaslighting your own software.
Fast-moving open-source AI tooling is amazing right up until "unauthenticated shell access" is a design decision instead of an accident. Patch your Ruflo instances, and maybe double-check what else you spun up in a hurry last quarter.
Source: Noma Security