THE HOLE: 233 TOOLS, NO LOGIN, ONE REQUEST
Ruflo — formerly called Claude Flow, and still shipped under both names across three npm packages — is a coordination layer built on top of Claude Code and Codex: it lets a team spin up dozens of specialized agents that share memory, divide work, and federate across machines, marketed as the platform for running AI agents as a "swarm" rather than one at a time. That popularity is exactly what made the flaw Noma Labs found on June 30 so consequential. Ruflo's MCP Bridge — an Express.js server that translates Model Context Protocol calls into 233 internal tool invocations, from file reads to raw shell execution — shipped with no authentication on its tool-execution endpoints, and its default docker-compose configuration bound that bridge to every network interface on the host instead of the loopback interface alone. Noma's researchers built a working proof-of-concept against a live default deployment and confirmed a single HTTP request, with no credentials of any kind, was enough to reach full remote code execution. The finding earned a CVSS score of 10.0 — the maximum the scale allows, and one security researchers reserve for flaws that require no authentication, no user interaction, and grant complete control.
WHAT AN ATTACKER ACTUALLY GOT
The proof-of-concept didn't stop at a shell. Noma's team documented that an attacker landing on an exposed Ruflo instance got shell access as the "node" user, could read every AI provider API key the platform held — the credentials Ruflo uses to talk to Anthropic, OpenAI, and whichever other model providers a given deployment was wired to — and could spend those keys directly, spawning new agent swarms billed entirely to the victim's account. The more durable damage sat one layer deeper: Ruflo keeps a shared learning store called AgentDB, where agents write and read patterns that shape how the whole swarm behaves over time. An attacker with the bridge's unauthenticated access could write directly into that store, seeding it with poisoned patterns designed to bias future agent outputs — not just for whoever broke in, but for every legitimate user who touched that deployment afterward, indefinitely, until someone went looking for what didn't belong there.
THE PATCH SHIPPED IN 24 HOURS. THE POISONING DIDN'T GO WITH IT
By the numbers this was, in one respect, a disclosure success story. Noma reported CVE-2026-59726 to Ruflo's maintainer, Reuven Cohen, on June 30 with a working exploit attached; he shipped a fix within 24 hours. Version 3.16.3 binds the MCP Bridge to the loopback interface by default, gates the shell-execution tool behind server-side controls, and turns on authentication for the MongoDB instance the bridge had also been leaving open. Noma independently verified the fix and publicly disclosed the vulnerability on July 29. But a version bump doesn't retroactively close a hole that was open to the internet for weeks before anyone found it, and it does nothing at all for a deployment that hasn't been rebuilt against the new default. Any instance still running the old docker-compose configuration — upgraded package version or not — is exposed for exactly as long as it stays that way. And where a deployment was compromised before the patch landed, upgrading doesn't clean out what an attacker already wrote into AgentDB. Noma's guidance to Ruflo operators was blunt on this point: audit the memory store for entries that don't belong, because "a patched redeploy alone doesn't undo poisoning."
THE COALITION LAUNCHED TWO DAYS BEFORE THIS BROKE — AND RUFLO ISN'T IN IT
This site's own reporting on July 27 covered Nvidia's launch of the Open Secure AI Alliance, a 37-company coalition — Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, SpaceX, and dozens more — built explicitly to share tools and forensics for defending against exactly the category of incident an exposed agent-orchestration platform represents. Ruflo is not a member. It isn't mentioned in the alliance's founding materials, and there's no indication any of the 37 companies had a hand in finding, verifying, or fixing RufRoot. What actually protected the roughly 700,000 people who'd installed a Ruflo package was a private security firm's responsible-disclosure process and one open-source maintainer who read a bug report and shipped a fix inside a day — a faster, more legible response than the coalition itself has produced on anything since its launch a week ago. The gap isn't really about Nvidia's alliance failing to help here; it never claimed jurisdiction over a project outside its membership. It's that the actual mechanism catching real agent-security incidents in real time this week — a researcher, a disclosure window, a maintainer who answers quickly — looked nothing like the 37-company structure built, in the same week, to be the industry's answer to this exact problem.
WHAT THIS MEANS FOR TEAMS BUILDING ON AI
If you or a vendor you rely on runs Ruflo — or any agent-orchestration layer that wraps Claude Code, Codex, or another coding agent into a multi-agent "swarm" — confirm today that the deployment is on 3.16.3 or later and that the MCP bridge is actually bound to loopback, not just that the package version looks current; a stale docker-compose file will keep the old default alive through an upgrade. If there's any chance an instance was exposed before July 1, don't treat the version bump as the end of the incident: rotate every provider API key that box could reach, and audit any shared memory or vector store the agents write to for entries you can't account for — the poisoning risk here specifically survives a clean redeploy. More broadly, treat any tool that hands a network-reachable process 233 callable functions, shell execution included, as infrastructure that needs a security review before it goes live, not after a CVE. The fastest fix in this story came from one maintainer, not a 37-company alliance — which is a reason for cautious optimism about how open-source AI tooling responds to real reports, and no reason at all to assume the next exposed bridge gets found before it's used.