In short: On 3 August 2026 researchers at Noma Labs disclosed CVE-2026-59726 (dubbed "RufRoot"), a maximum-severity flaw (CVSS 10.0) in Ruflo, a popular open-source platform for running AI agents. A single web request with no password gave a remote attacker full command execution — enough to steal the OpenAI, Anthropic and Google API keys stored on the server, read users' AI conversations and even poison the AI's long-term memory. Patch to version 3.16.3, rotate any exposed keys, and below is why this matters even if you have never heard of Ruflo.
What happened
Ruflo is an open-source platform that lets developers run and coordinate groups of AI agents, keep context between them and connect external tools through the Model Context Protocol (MCP). Noma Labs found that its "MCP Bridge" — an Express.js server listening on port 3001 — exposed 233 tools over HTTP with no authentication at all. One unauthenticated POST request could invoke a tool that runs shell commands, handing an attacker a command line inside the server with no password required. The flaw scored the maximum 10.0 on the CVSS scale. After responsible disclosure on 30 June 2026, the developers shipped a fix within 24 hours; the details were made public on 3 August 2026.
This is the same class of risk we have covered as AI systems move from demos into production — see our note on high-risk vulnerabilities in AI apps. The tooling is new, but the mistake — a powerful service left open to the internet with no auth — is very old.
What an attacker could do
Command execution on the server was only the start. With that access, an attacker could read the provider API keys — OpenAI, Anthropic, Google, OpenRouter — kept in the server's environment variables, and use them to run up charges on someone else's account. They could read the user conversations and metadata stored in the platform's database. They could install a lasting backdoor, and spin up a swarm of AI agents under their own control.
The nastiest part is memory poisoning. Ruflo keeps a long-term "learning store," and the attacker could plant malicious instructions there. Because that memory survives an update, tampering can keep steering the AI's answers for every future user long after the hole itself is patched. That is why Noma Labs calls the fix "patch-resistant": installing 3.16.3 closes the door, but does not undo poisoning that already happened.
What it means for an ordinary user
You do not run Ruflo, but companies whose chatbots and assistants you use might run a platform like it. When a server that orchestrates AI agents is breached, two things you care about are exposed: the conversations you typed into that assistant, and the trustworthiness of its answers. Leaked API keys are the operator's billing problem; leaked chats and manipulated responses are yours. The lesson is not about one product — it is that whatever you tell an AI assistant lives on someone else's server, and that server can be broken into.
How to protect yourself
Share less with AI chatbots. Treat anything you type into an online assistant as data that could leak. Keep passwords, card numbers, documents and other sensitive details out of the chat box.
If you run AI infrastructure, patch and rotate now. Update Ruflo to 3.16.3, treat every provider credential as compromised and rotate it, audit the agent memory for tampering, and rebuild containers from a clean image. Never expose an MCP bridge or admin service to the open internet without authentication.
Lock down your accounts. Use unique passwords with a manager and turn on two-factor authentication, so a leak on one service does not cascade to the rest.
Protect your connection on untrusted networks. A no-logs VPN encrypts your traffic and replaces your real IP with a server address, so the network you are on cannot see or read what you send. Be clear on the limit: a VPN protects data in transit — it cannot secure a server you do not control or unsend a chat you already typed. Use it as one layer of privacy hygiene, not a cure-all. LiMP VPN is a no-logs service for iOS and Android — see the plans and follow more security news on our blog.
Sources
Based on the technical disclosure by Noma Security (Noma Labs), who discovered the flaw, and independent reporting by The Hacker News and SecurityWeek. Russian-language coverage by SecurityLab.