Nothing says "we moved fast" quite like shipping 233 tools through a network port with the door wide open and no bouncer checking IDs. That's the story behind RufRoot, and if you're self-hosting AI agents, this one deserves your full attention.
233 Tools, Zero Locks on the Door
Security researchers at Noma Security disclosed a maximum-severity flaw — CVSS 10.0, tracked as CVE-2026-59726 — in Ruflo, an open-source agent meta-harness built for Anthropic Claude Code and OpenAI Codex. The bug, nicknamed RufRoot, lives in Ruflo's Model Context Protocol bridge: by default, deployments bind to port 3001 on all network interfaces, exposing an unauthenticated /mcp endpoint that forwards JSON-RPC tool execution calls with zero checks for authentication, API keys, or access control.
Among the 233 exposed tools were shell command execution, database operations, agent management, and memory storage — meaning an attacker with network access could run arbitrary commands, extract provider API credentials, read stored user conversations, or quietly rewrite an AI agent's memory to manipulate its future behavior. All versions before 3.16.3 are affected.
Poisoning the Memory, Not Just the Machine
The scarier part isn't the remote code execution, though that's plenty scary on its own — it's the memory poisoning angle. An attacker who can tamper with an agent's stored context can shape what that agent believes and does going forward, a kind of slow-motion manipulation that's much harder to detect than a one-off exploit.
The good news: after responsible disclosure on June 30, maintainer Reuven Cohen shipped a fix within 24 hours, binding the MCP bridge to loopback by default, gating shell execution behind server-side controls, and enabling MongoDB authentication. The uncomfortable lesson is broader — as more of us bolt agent orchestration tools onto our workflows, "binds to 0.0.0.0 by default" is turning into one of the most common ways good intentions become bad headlines.
If you're running Ruflo, patch to 3.16.3 today, not after your next coffee break. Your agent's memory — and your API bill — will thank you.
Source: The Hacker News