Noma Labs Discovers Critical Vulnerability in Widely Adopted Open Source AI Agent Platform Ruflo

Single unauthenticated request gave attackers full control of the platform, its data, and its AI Memory

NEW YORK, July 29, 2026 /PRNewswire/ -- Noma Security, the market-leading enterprise AI and agent security platform, today disclosed RufRoot, a maximum severity (CVSS 10.00) vulnerability discovered by Noma Labs in Ruflo, the leading agent meta-harness used to deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems with approximately 66k GitHub stars and one of the most widely adopted platforms in the Model Context Protocol (MCP) ecosystem.

Noma Security researchers discovered that Ruflo exposed hundreds of AI tools, including shell command execution, via an unauthenticated MCP bridge open to the network by default, and demonstrated that a single HTTP request was enough to gain full remote code execution inside a Ruflo deployment. From that foothold, an attacker could steal the API keys Ruflo uses to talk to AI providers, read every user conversation stored on the platform, and tamper with the AI's own memory in ways that would influence its responses to future users long after the attacker had gone.

Noma Labs responsibly disclosed the vulnerability to Ruflo maintainers on June 30th, including a working proof-of-concept confirmed against a live default deployment. Ruflo responded rapidly and released a comprehensive fix, defaulting the platform to a locked-down configuration with public exposure treated as an explicit opt-in requiring authentication within 24 hours. Noma Labs independently verified the fix. The vulnerability is being tracked as [CVE-2026-59726].

The Rise of AI Swarm Risks

Traditional software vulnerabilities allow malicious actors to steal data or take over a server. The Ruflo vulnerability enabled spinning up a swarm of agents to do whatever the attacker wanted and even tamper with the AI's memory. The ability to write malicious instructions into a platform's persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended. For organizations exposed to a vulnerability like this, remediation requires more than a software update. AI provider credentials should be treated as compromised and rotated, the platform's AI memory should be audited for tampering, and containers should be rebuilt from a clean image.

Securing AI Agents at Runtime

Noma's AI and agent security platform is purpose-built for exactly this class of risk. It provides continuous discovery of AI agents and their supporting infrastructure across the enterprise, agent identity and access control at the tool level, and runtime detection of the behavioral patterns that indicate credential theft, data exfiltration, and AI memory tampering. Noma's Agentic Access Control surfaces exposed agent interfaces and blocks dangerous tools from being invoked without policy approval. Noma AI-DR correlates agent sessions end-to-end, catching multi-step attacks that individual security tools would treat as unrelated events.

To learn more about how Noma protects AI agents and their deployments, visit https://noma.security.

Media Contact
ICR for Noma
[email protected]

SOURCE Noma Security