The security company Noma Security has uncovered a critical vulnerability in the open-source AI agent platform Ruflo, with a CVSS score of 9.8 out of 10. Through a single unauthenticated network request, attackers could remotely control foreign installations, steal access keys, and manipulate the persistent memory of the AI agents. The provider closed the gap with version 3.16.3; all previous releases were affected.
Open Interface Exposes 233 Tools Without Protection
Ruflo is open-source software that allows companies and developers to coordinate multiple AI agents to work together – for example, in conjunction with Anthropic’s Claude Code or OpenAI’s Codex. The project has around 67,000 stars on GitHub and more than ten million downloads – numbers that are not independently verified. The core of the architecture is a so-called MCP bridge, a server that provides tools such as terminal commands, database access, or storage functions for the agents.
That’s where the problem lay: In the default configuration of the Docker setup, the bridge bound network port 3001 to all interfaces and provided 233 tools without any authentication. A single unauthenticated HTTP POST request to the endpoint “/mcp” was sufficient to invoke any function of the bridge. According to the official security advisory on GitHub, attackers gained shell access as the system user “node” within the bridge container – enough to execute arbitrary commands.
Attackers Gain Access Keys and Persistent Memory
From the shell, attackers could read all environment variables of the container, including the access keys for the connected language model providers. With these keys, they could make their own requests at the expense of the affected parties or launch complete swarms of agents under foreign control. The associated MongoDB database, where Ruflo stores conversation logs and learning patterns, was also accessible by default without a password.
Particularly critical: through the database, the so-called AgentDB pattern store could be manipulated, where Ruflo stores recurring behavior patterns for its agents. Anyone who deliberately places poisoned entries here can permanently change the behavior of the AI agents for all users of an installation – for example, by classifying malicious code as trustworthy. In a demonstration, the research team showed a complete attack chain from the first request to permanent backdoor access, including the elimination of traces.
Ruflo Patches Within a Day, Operators Must Act Themselves
Security researcher Eli Ainhorn responsibly reported the vulnerability to Ruflo founder Reuven Cohen on June 30, 2026. According to the release notes for version 3.16.3, the project released a patch on July 1, 2026. The new version now binds the MCP bridge by default only to the local address 127.0.0.1, requires an access token for public access, and disables the terminal function unless explicitly activated. The database has also required a password since then.
Ruflo is free, open-source software that is uniformly available for download worldwide via GitHub and the npm package manager – there is no restriction for Germany or the EU. Anyone running an older version should immediately update to 3.16.3 or newer, secure ports 3001 and 27017 via firewall, replace all keys for connected AI providers, and check the AgentDB pattern store for suspicious entries.
It remains open how many of the approximately one million active Ruflo installations, according to the project, still operate the open default configuration unchanged – unpatched servers remain discoverable through automated scans even weeks after the vulnerability is made public. The case is also part of a series of security incidents surrounding autonomous AI agent frameworks, as demonstrated recently by the misuse of the open-source tool Hermes Agent for automated attacks on more than 460 systems. The more companies deploy agents with extensive tool rights, the more the risk shifts from the quality of individual models to the security of the surrounding infrastructure.
