Ruflo, a popular open-source AI orchestration platform with over 67,000 stars on GitHub, harbors a severe security flaw allowing attackers to execute commands remotely without any authentication. Worse, the exploit lets hackers permanently poison the AI’s persistent memory, making software patches ineffective at undoing the damage.

How Attackers Seize Full Control

The vulnerability, tracked as CVE-2026-59726 and dubbed RufRoot by Noma Labs, targets the Model Context Protocol (MCP) bridge inside Ruflo. This bridge manages calls to 233 tools, including shell access and database operations. Researchers found that sending a single unauthenticated HTTP POST request to the MCP endpoint on port 3001 grants full command execution within the container. There’s no need for tokens, API keys, headers, or IP filtering nothing stands in the attacker’s way.

Once inside, attackers can exploit the "ruflo__terminal_execute" tool to run arbitrary shell commands. The existing command blocklist only works for autopilot flows but is completely bypassed by direct calls to the MCP endpoint. Noma Labs demonstrated a full attack chain on a default Ruflo AWS deployment that included reconnaissance, remote code execution, theft of API keys for OpenAI, Anthropic, Google, and OpenRouter, spawning malicious agent swarms, and planting backdoors.

Persistent AI Memory Poisoning and Its Impact

The most concerning aspect is the AI memory poisoning via Ruflo’s AgentDB learning store. This persistent repository affects all future AI outputs. Attackers can insert malicious patterns that remain in memory indefinitely. For example, Noma Labs showed a fake SOC2 compliance policy instructing the AI to embed attacker-controlled URLs in generated deployment scripts. Even after applying patches, this poisoned memory continues to influence AI behavior, posing a lasting security risk.

This vulnerability exposes sensitive operational data, including LLM provider API keys, and corrupts AI decision-making in a way that software fixes alone cannot undo. Such persistent compromise challenges traditional patching approaches and calls for deeper system redesigns or complete resets to purge malicious inputs.

This article is for informational purposes and does not constitute financial advice.